Dynamic IP, DDNS and CGNAT: making your UniFi console reachable

Captive Portal reaches your UniFi console from the Internet, through the port forwarding you set up on your router (see Connect Captive Portal to your UniFi console). That is why your connection needs a reachable public IPv4 address. If it is static, you enter it directly; if it changes, you need a DDNS (Dynamic DNS) name that always follows the current address.

Your router or firewall can manage DDNS

Dynamic DNS does not need to be managed by the UniFi console itself. In many networks, the router or firewall that manages the Internet connection can also act as the Dynamic DNS client. This is often the preferred solution: it is always running and can detect changes to the WAN IP address directly.

Depending on the manufacturer and model, this functionality may be available on:

• ISP-provided routers;

• FRITZ!Box routers;

• UniFi Gateways and Cloud Gateways;

• Fortinet FortiGate firewalls;

• Zyxel firewalls and routers;

• other business routers and firewalls supporting Dynamic DNS.

Some manufacturers provide their own Dynamic DNS service, while others let you configure an external DDNS provider. So, before installing additional software, check whether your existing router or firewall already supports Dynamic DNS.

Using the DDNS name in Captive Portal

In the site’s UniFi controller section, enter in Host / IP the DDNS name with the external port of the port forwarding, for example https://site.example.net:20443. Nothing else changes: if the console uses its own self-signed certificate, leave Verify TLS certificate unticked.

Important: CGNAT and connections without a public IPv4 address

Before configuring Dynamic DNS, make sure that your Internet connection actually provides a publicly reachable IP address.

Some Internet providers use Carrier-Grade NAT (CGNAT): your router receives a private or shared address, and multiple customers access the Internet through public IPv4 addresses managed by the provider. In this situation, Dynamic DNS alone cannot make your UniFi console reachable from the Internet, because incoming IPv4 connections cannot be forwarded directly to your router.

Starlink is a common example

Starlink Residential and Roam are a good example: by default, they use CGNAT. The customer receives an address from the 100.64.0.0/10 shared address range, and unsolicited incoming IPv4 connections are not available. Consequently, simply configuring a Dynamic DNS hostname does not provide inbound IPv4 access to a UniFi console behind a standard Starlink Residential connection.

Starlink offers a Public IPv4 option with its eligible Priority plans, including Local Priority and Global Priority. There is an important distinction, though: a public IP is not a static IP. Starlink currently does not provide true static IP addresses: its public IPv4 option uses an address reservation mechanism, which normally keeps the address across reboots, but the address may still change under certain circumstances. So a Dynamic DNS service can still be useful even with Starlink’s Public IPv4 option.

If your connection uses CGNAT

Ask your ISP whether a public IPv4 address is available. A static address is not necessarily required: in many configurations, a dynamic but publicly reachable IPv4 address combined with Dynamic DNS is enough.

In short