Skip to content
Avanet

Set up and verify Dynamic DNS on Sophos Firewall

Sophos Firewall

Under Network > Dynamic DNS > Add, a hostname from the DDNS provider is associated with the corresponding WAN interface. Select Use port IP when the Sophos Firewall itself has the public IPv4 address. Select NATed public IP when it has a private WAN address behind a router.

Dynamic DNS only updates the DNS record. It does not open ports or create NAT or firewall rules. To make an internal server behind the firewall reachable, the additional steps in Publish a server using DNAT must also be configured correctly.

Configure Dynamic DNS

A hostname such as vpn.example.net must already be registered with the provider, and valid update credentials are required. The firewall must be able to resolve DNS and reach the internet and the provider. Dynamic DNS therefore does not work in an air-gapped environment.

  1. Go to Network > Dynamic DNS and click Add.
  2. Under Hostname, enter the name created with the provider, for example vpn.example.net.
  3. Select the corresponding WAN Interface, for example Port2 - WAN.
  4. Under IPv4 address, select Use port IP or NATed public IP.
  5. Select the Service provider.
  6. Enter the Login name and Password or the provider-specific update key.
  7. Click Save and check the status.

The current SFOS dialog lists DynDNS, DynAccess, EasyDNS, ZoneEdit, Google DDNS, Namecheap, DNS-O-Matic, No-IP, FreeDNS and Cloudflare. The former Sophos service myfirewall.co has been discontinued. If a provider does not require a username, Sophos instructs administrators to enter the domain as the Login name. For FreeDNS, the password in SFOS must not exceed 15 characters.

Use port IP or NATed public IP

  • Use port IP: The selected WAN interface itself has the public IPv4 address.
  • NATed public IP: The WAN interface has a private address and an upstream router performs NAT. To determine the public address, the firewall must also be able to reach checkip.cyberoam.com over TCP 80.

Bridge interfaces do not support Dynamic DNS. If WAN interfaces are modified or replaced, check the dependencies under Object usage and then verify the DDNS entry. Use zones and interfaces correctly explains further interface limitations.

Connect Cloudflare securely

The built-in Cloudflare provider requires the account email address and the Global API Key. The current Sophos documentation does not list a restricted API token as a compatible credential.

Cloudflare classifies the Global API Key as legacy: It has the same permissions as the user and access to that user’s resources. For the SFOS integration, use a separate Cloudflare user limited to the required zone and DNS role. The key must not appear in screenshots or tickets. If a Global API Key is not permitted by the security policy, use an external updater with a restricted API token or another supported provider instead.

For VPN and other services that connect clients directly to the firewall’s public IP address, the Cloudflare record must be set to DNS only. If the proxy is intentionally enabled, DNS queries return Cloudflare anycast addresses instead; in that case, check the DDNS origin IP in the Cloudflare dashboard.

Verify DDNS resolution and the service

SFOS checks every five minutes whether the public IP address has changed. After saving, first check under Network > Dynamic DNS whether the status and updated IP address are plausible.

Then query the hostname using a resolver outside the local DNS cache. On Linux and macOS:

dig @1.1.1.1 vpn.example.net A +short

On Windows:

nslookup vpn.example.net 1.1.1.1

The response must match the expected public IPv4 address. Immediately after a change, a resolver may still return the old address because of the DNS TTL and cache.

Finally, test the actual service from another network, such as a mobile connection. A correct DNS response proves only name resolution, not that the service is reachable.

Multi-WAN, HA and CGNAT

After a WAN or HA failover, always check the DDNS status, the external DNS response and the service.

  • Multi-WAN: Each DDNS entry is bound to one selected interface. Do not assume that a single hostname automatically follows the active gateway. Plan a unique hostname for published services on each WAN.
  • HA: Troubleshooting logs are not synchronized between the nodes. Set up Sophos Firewall High Availability explains the complete failover test.
  • CGNAT: NATed public IP may publish the provider’s shared address, but it does not make the firewall reachable from the internet. This requires, for example, a genuine public IPv4 address, a separately maintained AAAA record with appropriate IPv6 firewall and service configuration, or an outbound tunnel or relay solution. The SFOS DDNS described here updates IPv4 only.

Troubleshooting

In Log Viewer, select Events and System, then search for the DDNS component. The technical field values are log_type=Event, log_subtype=System and log_component=DDNS; the relevant fields are Status, Message and Failure reason. Option 4 Device Console also shows the latest entries:

show logs ddc.log lines 100

For live analysis, use the following command from Device Management > Advanced Shell in the SSH menu and stop it with Ctrl+C:

tail -f /log/ddc.log

The commands and the association with ddc.log are documented for SFOS 22, but were not executed against a customer firewall for this article. Further log files and access methods are listed under Sophos Firewall service logs.

  • Invalid Configuration or bad authorization: Check the hostname, provider and credentials. Cloudflare requires the account email address and Global API Key.
  • Invalid IP: Check the interface and the Use port IP or NATed public IP selection.
  • DNS Error or Connect Failed: Check DNS, the Default Route, internet access and provider reachability. For NATed public IP, also verify the check-IP connectivity described above.
  • Invalid Response or Reported Abuse: Check the provider status, account, blocks and provider limits.
  • Success, but wrong IP: Compare the provider dashboard, selected interface, IP option and external DNS response.
  • FQDN is correct, but the service is unreachable: Check the upstream port forwarding, DNAT, firewall rule and the relevant VPN or service configuration.

If Cloudflare DDNS has failed only since upgrading to SFOS 22.0 MR1, update to SFOS 22.0 MR2 Build 546 or later and test again. Sophos fixes NC-180219 in this release; details are available in the SFOS 22 MR2 article.