Why DDNS service can not auto-update public IP address when firewall is behind NAT router?

Zyxel_Stanley

Question:
Why does my firewall use its WAN interface IP instead of the actual public IP for DDNS, and is there a way to make it use the public IP when the firewall is behind a NAT router?

Answer:
When the firewall is installed behind a NAT router, its WAN interface receives a private IP address, not the real public IP. As a result, the firewall can only update DDNS using the private WAN IP it detects locally and cannot directly identify or synchronize the true public IP.

However, if your firewall is online in Nebula, the server can automatically generate a DDNS hostname for the device. You can find this Nebula-assigned FQDN under:
Site-wide > Configure > Firewall > Remote access VPN
It will display a unique domain name that can be used for remote access without requiring the firewall to know the public IP directly.