Changing public IP

Home and small-business connections get a new public IP every time they reconnect. If your domain points directly at that IP, the moment it changes nothing opens from outside. The only symptom is a timeout, so the cause is hard to see.

Make the name follow the changing IP. Then you can run services even on a home or office line — our own server also runs this way on a home connection.

First, do you have a public IP?

If your line is CGNAT, the ISP shares one public IP among many subscribers, so there is no address assigned to you. Even if the name follows it, there is no way in from outside.

curl -s https://api.ipify.org      # the public IP the internet actually sees

Compare this value with the WAN IP in your router's admin screen.

Same	You have a public IP → Go to DDNS
Different (especially if the WAN is 100.64.x.x–100.127.x.x)	It's CGNAT → Go to the tunnel

Making the name follow the IP with DDNS

This updates the domain record whenever the IP changes. Do it one of two ways.

Method	How
Router built-in DDNS	Most routers have it. The router detects IP changes itself and updates, so nothing needs to be installed on the server. Check this first.
DDNS service + update client	When the router lacks the feature. Get a name from the service and run an update client on the server.

Either way the result is the same — you get one name that follows the changing IP, and your actual service domain points to that name with a CNAME.

paas.example.com      CNAME   myname.ddns-service.net

Don't put the IP directly on the service domain

With A record → public IP, you have to fix it by hand on the day the IP changes, and it stays down until you do. Keeping one level as a CNAME gathers the place that gets updated into one spot.

Keep TTL low — 60 seconds recommended

Recovery time is update interval + TTL. If you leave TTL on "auto" it's actually around 5 minutes, and right when the IP changes it gets cached with that value, so you wait 5 minutes.

Certificate renewal is blocked too

While the IP is out of sync, certificate renewal also fails, because issuance verification comes in on that address. It stays quiet for now because the certificate is still valid, and surfaces at renewal time.

If it's CGNAT, use the tunnel

This approach doesn't use a public IP at all. The server connects outward, so you don't need a public IP, and you don't need to open ports on the router.

→ 9. Certificates and addresses

If you have a public IP, DDNS is better

With the tunnel, traffic passes through our servers, so you depend on the state of our side. Serving directly on your own public IP has no such dependency.