# Dynamic IP isn't updating > What to check when a Dynamic IP isn't doing what you expect, organised by what you're seeing. Source: https://infranest.io/docs/dynamic-ip-troubleshooting Last updated: 2026-09-18 --- If your Dynamic IP isn't updating your address, isn't updating your DNS, or has dropped out of a firewall rule, this article walks through what to check based on exactly what you're seeing. It's for anyone managing a Dynamic IP in InfraNest. ## Overview - Most problems can be diagnosed from a single line: on the Dynamic IP's **Setup** tab, look under **Has your router reached us?** It tells you whether anything has arrived, from where, and whether the password was right. - The sections below are organised by symptom — find the one that matches what you're seeing. ![Dynamic IP isn't updating](/media/8a5e7174-8eca-4986-80f8-0ee50aed5dcc) ## Fix "Waiting for your router" when nothing ever arrives This means your router isn't reaching InfraNest at all. 1. Check the Server box has no `https://` in it. Routers often add this automatically, which breaks the address — this is by far the most common cause. 2. Save the settings again in your router. Many routers only send an update when you save, or when your address changes — some have a "force update" button. 3. Look for a "last result" or "status" line in your router's DDNS screen. If it mentions a name resolution or connection error, the address in the Server box is wrong. ## Fix a wrong password If the Setup tab says your router reached InfraNest but the password was wrong: 1. Select **Show** next to Password. 2. Copy the password again. 3. Paste it into your router, replacing what's there rather than editing it — passwords are long and easy to truncate when copying by hand. > [!NOTE] > If you recently chose **Replace the password**, the old one stopped working immediately, and your router needs the new one. ## Understand "your address can't be reached from the internet" This appears on a linked DNS record and means your router reported an address the internet can't reach, so nothing was published. This almost always means your connection is behind carrier-grade NAT — your provider shares one public address between many customers, so the address your router sees isn't really yours. 1. Contact your internet provider and ask for a public IP address (sometimes called a "static IP" or "public IP" option — many offer one free or for a small fee). 2. If your provider offers IPv6, check whether that's affected — it usually isn't. Dynamic DNS can't work around carrier-grade NAT, and no setting in InfraNest will fix it. ## Fix a record showing a new address while the old one still resolves 1. Check whether your DNS provider has accepted the change yet. If the record says it's pending, InfraNest retries every time your router checks in. 2. If this persists for more than an hour, check that the integration for that provider is still connected. 3. If the record looks correct in InfraNest, the old answer may simply be cached. DNS answers linger for as long as the record's TTL — records created in InfraNest use five minutes, but a record created elsewhere may be much longer, and some networks cache beyond what they're told. ## Fix a firewall rule that stopped following your address You'll get an alert, and the rule shows as no longer connected. What to do depends on the message: **"This firewall rule has changed or no longer exists."** The rule's port or protocol was edited — in InfraNest or in your provider's own console — so InfraNest can no longer tell which rule to update. The address last allowed may still be sitting in whatever rule replaced it. 1. Check your firewall at your provider. 2. Either remove that leftover entry, or re-attach the Dynamic IP to the rule as it now exists. **"This firewall rule was deleted."** Nothing was left behind — the entry went with the rule. 1. If you still want the address kept up to date, add the rule again. 2. Re-attach the Dynamic IP to it. ## Understand what happens to the address when you stop tracking a firewall rule When a Dynamic IP keeps a firewall rule up to date, it puts your current address into that rule. Removing the tracking doesn't remove the address — so InfraNest asks first, whether you're deleting the Dynamic IP, removing one target, or deleting the whole firewall. - **Take it back out of the rule.** The rule stops allowing that address; everything else the rule allows is untouched. You can add the address again later by re-attaching the Dynamic IP. This is the reversible choice. - **Leave it in the rule.** The address stays allowed. InfraNest lists it on the firewall as an address nobody is keeping up to date, so it doesn't quietly disappear from view. That listing goes away by itself once the address is no longer in the rule. Which option is pre-selected comes from the Dynamic IP's own **"Remove firewall access if this stops checking in"** setting. > [!WARNING] > If InfraNest can't reach your provider at that moment, the address stays in the rule and you're told so rather than being shown a clean delete. It'll be listed on the firewall so you can remove it yourself. ## Understand deleting a firewall in InfraNest vs. at your provider Deleting a firewall in InfraNest only removes InfraNest's copy of it. The firewall itself stays at your provider, with all its rules still filtering — including any address a Dynamic IP put there. That's why deleting asks about those addresses first: it's the last moment InfraNest can take them out. ## Recover from deleting something a Dynamic IP was using Whatever you removed, the Dynamic IP tells you rather than quietly carrying on, and keeps the target so you can see what it was. 1. Go to the Dynamic IPs page. 2. Either remove the leftover target using the bin icon next to it, or restore what was deleted — it starts working again on the next check-in, with no need to set it up a second time. What "restore" means depends on what was deleted: - **A DNS record** — nothing is published anywhere any more. Restoring the record from the recycle bin is enough. - **A DNS zone** — the records went with it, so there's nothing left to publish to. - **A firewall** — the rule went with it, so nothing was left behind at your provider. - **The connection to your provider** — the firewall rule is untouched and still allows the address last written. Re-connect the provider to resume updates, or remove the entry if you no longer want it. > [!NOTE] > If the thing was deleted in your provider's own control panel rather than in InfraNest, you'll hear about it the next time that zone syncs — the message will say so. ## Recover a Dynamic IP detached by something you removed When you remove a firewall rule or delete a DNS record that a Dynamic IP follows, InfraNest warns you before you confirm and names the Dynamic IP involved. 1. For firewall rules, look for the warning on the **Apply changes** dialog — it also appears when editing a rule's port, which detaches the Dynamic IP just as surely as deleting the rule. 2. Use the option there to remove the tracking at the same time, or leave it unticked to keep the tracking (shown as stopped) so you can re-attach it to another rule later instead of setting it up again. ## Fix a firewall rule that says "Not in effect" This means the address is being kept up to date, but the firewall it's in isn't attached to any server, so none of its rules filter anything. 1. Open the firewall. 2. Attach it to the server you meant to protect. Until you do, treat the rule as if it weren't there — a port you think is closed is still open. If it says the firewall can't be seen any more, it was deleted from InfraNest — see "Recover from deleting something a Dynamic IP was using" above. ## Fix a record stuck on 192.0.2.1 That address is a placeholder put in when you create a record before your router has ever checked in. It's replaced the moment the first update arrives — so seeing it still means no update has arrived yet. Work through "Fix 'Waiting for your router' when nothing ever arrives" above. ## Turn on alerts for IP changes Alerts on change are off by default. 1. Open the Dynamic IP's options. 2. Turn on **Alert me when the IP changes**. Firewall changes are always alerted regardless of this setting. ## Troubleshooting **It worked for months and then stopped.** Check the **Last contact** line. If it's days old, something likely changed at your end — a router replaced or reset, a firmware update that cleared the DDNS settings, or an ISP change. InfraNest sends a message when a Dynamic IP goes quiet, so check whether that arrived. If a firewall opening was involved, it's removed after about a week of silence to stop an abandoned setup leaving a port open — you're warned before that happens, and re-connecting your router restores it. **Only some records update, not all.** Check the record types. A router reaching InfraNest over IPv6 can only update **AAAA** records; one on IPv4 can only update **A** records. If you have both kinds linked and only one is moving, your router is only reporting one address. Most routers let you enable IPv4 and IPv6 updates separately in their DDNS settings. > [!TIP] > Whenever something looks stuck, start with the **Setup** tab's **Has your router reached us?** line — it usually tells you exactly where things went wrong.