Dynamic DNS
The dynamic DNS service updates the DNS record (an A record for IPv4 or an AAAA record for IPv6) that maps your hostname to your device whenever your IP address changes, so you can always reach your device by hostname.
Two update mechanisms are available:
Direct DNS update (RFC 2136): Updates the record by sending an RFC 2136 DNS UPDATE message to an authoritative DNS server. Use this option when you run your own DNS server.
Hosted DNS update: Updates the record by sending an HTTP(S) update request to a third-party dynamic DNS provider (such as Cloudflare, DuckDNS, deSEC, or DynDNS). Use this option when relying on an external provider.
Configuration
Common commands
The following commands apply to both direct and hosted DNS updates.
Configure the interface whose IP address the dynamic DNS record points to.
Note
Mutually exclusive with address web within the same dynamic DNS
<service-name> configuration.
Example:
set service dns dynamic name VyOS-DNS address interface eth0
Configure a description for the dynamic DNS service configuration.
Limited to 255 characters.
Example:
set service dns dynamic name VyOS-DNS description 'RFC 2136 dynamic DNS service'
Configure a hostname whose DNS record is kept updated with the current IP address.
Accepts a standard hostname, @ for the zone apex, or * for a
wildcard record. Repeat the command to add several hostnames to the
same dynamic DNS <service-name> configuration.
Example:
set service dns dynamic name VyOS-DNS host-name host.example.com
Configure the protocol used to send updates.
Use nsupdate for direct DNS updates, or a provider-specific protocol
such as cloudflare, dyndns2, or duckdns for hosted DNS updates.
Use CLI tab-completion to list the available protocols.
Example:
set service dns dynamic name VyOS-DNS protocol nsupdate
Configure the IP address or FQDN of the authoritative DNS server (direct DNS updates), or the provider’s endpoint (hosted DNS updates).
Required for nsupdate and optional for HTTP(S)-based protocols.
Example:
set service dns dynamic name VyOS-DNS server ns1.example.com
Configure the DNS zone that contains the configured hostnames.
The value must be an FQDN. Required for protocols cloudflare,
digitalocean, godaddy, hetzner, gandi, nfsn, and nsupdate.
Also accepted for dnsexit2 and zoneedit1. Not supported for any
other protocol.
Example:
set service dns dynamic name VyOS-DNS zone example.com
Configure the TTL, in seconds, of the updated DNS records.
The TTL sets how long DNS resolvers may cache the record before it must
be re-fetched. Supported only for protocols cloudflare, dnsexit2,
gandi, godaddy, hetzner, nfsn, and nsupdate. When unset, no
TTL is included in the update.
Example:
set service dns dynamic name VyOS-DNS ttl 300
Configure which DNS record types are updated:
ipv4: Updates the A record only.ipv6: Updates the AAAA record only.both: Updates both the A and AAAA records.
The default is ipv4.
both is supported only for protocols cloudflare, digitalocean,
dnsexit2, duckdns, dyndns2, easydns, freedns, hetzner,
infomaniak, and njalla.
Example:
set service dns dynamic name VyOS-DNS ip-version ipv6
Configure the interval, in seconds, between updates of the configured DNS records.
The default is 300.
Example:
set service dns dynamic interval 300
Running behind NAT
By default, the IP address configured under address interface is what
gets registered. When VyOS is behind NAT, this is the internal address
that cannot be reached from the public Internet. Configure address web
instead so the DNS record points to the public IP address.
Configure an HTTP(S) URL from which dynamic DNS obtains the IP address for the DNS record.
Note
Mutually exclusive with address interface within the same dynamic DNS
<service-name> configuration.
Example:
set service dns dynamic name VyOS-DNS address web url https://ipv4.icanhazip.com
Configure dynamic DNS to ignore URL response text before the specified pattern when extracting the public IP address.
Note
Requires address web url to be set within the same dynamic DNS
<service-name> configuration.
Example:
set service dns dynamic name VyOS-DNS address web skip 'Current IP Address:'
Direct DNS update (RFC 2136)
Configure the file containing the TSIG key used to authenticate direct DNS update messages.
The file must be within the /config/auth directory. Required when
protocol is nsupdate; other protocols use password instead.
Example:
set service dns dynamic name VyOS-DNS key /config/auth/my.key
Hosted (provider-based) DNS update
Configure the username presented in HTTP(S) update requests to the dynamic DNS provider.
Required for most protocols. Not required for 1984, cloudflare,
cloudns, digitalocean, dnsexit2, duckdns, freemyip, hetzner,
keysystems, njalla, nsupdate, and regfishde.
Example:
set service dns dynamic name dedyn username myusername
Configure the password, or provider API token, presented in HTTP(S) update requests to the dynamic DNS provider.
Required for every protocol except nsupdate, which uses key instead.
Example:
set service dns dynamic name dedyn password mypassword
Examples
Direct DNS update (RFC 2136)
The following example registers the DNS record example.vyos.io on the
DNS server ns1.vyos.io, keeps it updated with the current IP address
of eth0, authenticates updates with the TSIG key at
/config/auth/my.key, and sets a TTL of 300 seconds.
set service dns dynamic name VyOS-DNS address interface 'eth0'
set service dns dynamic name VyOS-DNS description 'RFC 2136 dynamic DNS service'
set service dns dynamic name VyOS-DNS key '/config/auth/my.key'
set service dns dynamic name VyOS-DNS server 'ns1.vyos.io'
set service dns dynamic name VyOS-DNS zone 'vyos.io'
set service dns dynamic name VyOS-DNS host-name 'example.vyos.io'
set service dns dynamic name VyOS-DNS protocol 'nsupdate'
set service dns dynamic name VyOS-DNS ttl '300'
Resulting configuration:
vyos@vyos# show service dns dynamic
name VyOS-DNS {
address {
interface eth0
}
description "RFC 2136 dynamic DNS service"
host-name example.vyos.io
key /config/auth/my.key
protocol nsupdate
server ns1.vyos.io
ttl 300
zone vyos.io
}
Note
You can define multiple dynamic DNS <service-name> configurations,
each registering its own set of DNS records.
Hosted (provider-based) DNS update
The following example registers the DNS record myhostname.dedyn.io
with deSEC via the dyndns2 protocol, keeps it updated with the current
IP address of eth0, and authenticates updates with the configured
username and password.
set service dns dynamic name dedyn description 'deSEC dynamic DNS service'
set service dns dynamic name dedyn username 'myusername'
set service dns dynamic name dedyn password 'mypassword'
set service dns dynamic name dedyn host-name 'myhostname.dedyn.io'
set service dns dynamic name dedyn protocol 'dyndns2'
set service dns dynamic name dedyn server 'update.dedyn.io'
set service dns dynamic name dedyn address interface 'eth0'
Note
You can define multiple dynamic DNS <service-name> configurations,
each registering its own set of DNS records.
The following example is the same as above, but restricted to IPv6: the
AAAA record for myhostname.dedyn.io is updated with the current IPv6
address of eth0, using deSEC’s IPv6 update endpoint
update6.dedyn.io.
set service dns dynamic name dedyn description 'deSEC IPv6 dynamic DNS service'
set service dns dynamic name dedyn username 'myusername'
set service dns dynamic name dedyn password 'mypassword'
set service dns dynamic name dedyn host-name 'myhostname.dedyn.io'
set service dns dynamic name dedyn protocol 'dyndns2'
set service dns dynamic name dedyn ip-version 'ipv6'
set service dns dynamic name dedyn server 'update6.dedyn.io'
set service dns dynamic name dedyn address interface 'eth0'