Dynamic DNS (DDNS): What It Is & How to Use It for a Self-Hosted VPN (2026)

If you host anything at home — a VPN, a NAS, a game server — you eventually hit the same wall: your public IP keeps changing, so you can never reliably reach your own network from outside. Dynamic DNS is the standard fix. It keeps a hostname permanently pointed at your current IP, so you connect to a name instead of a number that won't stay still. This guide explains what DDNS is, how it works, how to set it up for a self-hosted VPN, and when a VPS is the better base.

What dynamic DNS is

Most home internet connections come with a dynamic IP — an address your provider can change at any time, on a reboot or on their own schedule. That's fine for browsing, but it breaks anything that needs to be reached at a fixed location.

Dynamic DNS (DDNS) solves it with a small program — an updater — that watches your public IP and, whenever it changes, updates a DNS record to match. The result: a hostname like home.example.com that always resolves to your current address, no matter how often it changes.

Why a self-hosted VPN needs it

A WireGuard or OpenVPN client connects back to your server using an endpoint — an address and port. Host that VPN at home on a dynamic IP, and the endpoint moves every time your ISP rotates the address. Your phone, away from home, suddenly can't reconnect.

Point your clients at a DDNS hostname instead, and the endpoint becomes stable: the name follows the IP automatically, and your tunnels keep working through every address change. In a WireGuard config, you simply use the hostname in the peer's Endpoint = line.

How to set it up

1. Create a hostname. Use a DDNS provider (many routers include one) and register something like home.example.com.
2. Run the updater. Either enable your router's built-in DDNS with your account credentials, or run a client on the server — ddclient, or a small Docker-based updater that refreshes the record on a schedule.
3. Point your service at the hostname. Set your VPN endpoint (and anything else you expose) to the hostname rather than a raw IP.
4. Test. Confirm the hostname resolves to your real public IP, then verify a connection from an outside network (mobile data is a good test).

For the full server build, see setting up a self-hosted VPN on Contabo with WireGuard, the PiVPN one-line installer for a home Raspberry Pi, and reusable WireGuard config templates.

The catch: dynamic IP, CGNAT and uptime

DDNS only fixes the changing address problem. Two limits remain:

• CGNAT. Many ISPs (especially mobile and some fibre) put you behind Carrier-Grade NAT, where you don't have a real public IP at all — inbound connections are blocked and DDNS can't help. Check whether your public IP matches what your router reports; if not, you're likely on CGNAT.
• Home uptime and bandwidth. A home line goes down with power cuts and reboots, and upload speeds are often modest — fine for a personal tunnel, frustrating for anything you truly depend on.

When a VPS beats DDNS

If your VPN needs to be reliable — always reachable, good bandwidth, immune to CGNAT — a cheap VPS is the stronger base. It gives you a permanent public IP (no DDNS needed), better uptime than a home line, and full inbound access. A Contabo VPS at €4.99/month runs a personal WireGuard server with a fixed address out of the box. Compare hosts in our best self-hosted VPN guide.

DDNS is the right tool for a home server on a dynamic IP; a VPS is the right tool when you'd rather not depend on your home connection at all.

The bottom line

Dynamic DNS turns an unstable home IP into a stable hostname, which is exactly what a self-hosted VPN endpoint needs. Set up a free hostname and an updater on your router or server, point your WireGuard clients at the name, and your tunnels survive every IP change. Just watch for CGNAT — if your ISP blocks inbound connections, no DDNS will fix it, and a cheap VPS with a permanent public IP is the cleaner answer.

Editorial guide based on how dynamic DNS, dynamic ISP addressing and CGNAT work. Your results depend on your ISP and hardware. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.