How I made a home VPN with dynamic DNS for secure remote access

[javajolt]

Whether you're trying to protect your privacy, access your services, or avoid geographical restrictions when traveling, a VPN is one of the best upgrades you can make to your tech life. There are plenty of ways to set up a VPN at home, but if you're looking for a more classic OpenVPN or WireGuard setup, DDNS can help. A home VPN with dynamic DNS (DDNS) offers a secure way to access your resources remotely without opening up security vulnerabilities, and without worrying about constantly changing home IP addresses.

We’ll walk through the process of setting up a VPN at home, coupled with dynamic DNS, to ensure your remote connections remain secure and stable, even when your home IP address changes. While this is far from the only way to set up a great home VPN (setting up a VPN with Tailscale is another good option), it's often a great way to get up and running if you need a more advanced configuration using OpenVPN or want to run your own jump box.

Why you need a home VPN

Accessing your services has never been so easy



There are numerous reasons why setting up a home VPN makes sense, especially when security and privacy are top concerns. A VPN allows you to connect to your home network as if you were physically present, giving you access to networked services, devices, media servers, and anything else you want to run on your home network. However, many home ISPs assign dynamic IP addresses, which change over time - especially if your router reboots. This makes it difficult to connect to your home network remotely unless you know the current IP address. This is where a dynamic DNS comes in handy. DDNS services keep track of your IP address, even when it changes, and link it to a custom domain name, making remote access a breeze.

You'll need an existing domain setup to configure dynamic DNS. As specific instructions for setting this up will vary depending on your nameserver host, we'll keep these instructions fairly generic.

How to set up your home VPN

Choose the right VPN server software



The first step in setting up a home VPN is to choose the right server software. Open-source solutions such as OpenVPN and WireGuard are both popular options, with the latter increasingly being preferred over the legacy OpenVPN for its performance, extensibility, and stability. That said, there are great free alternatives for a DDNS WireGuard based VPN (e.g. Tailscale, Headscale), so we'll be using OpenVPN here. OpenVPN still remains popular in an enterprise setting for its tried and tested security.

Once you've chosen the VPN software, you need to install it on a device within your home network that will act as the VPN server. This could be your router (if it supports VPN features) or a dedicated machine, such as a Raspberry Pi, or even a NAS running TrueNAS or similar.



Configure the VPN server

After deciding on your VPN server software, the next step is configuration. How you configure your server is up to you, so we won't rehash it entirely here. We've already got great guides here on XDA for setting up your own VPN on Proxmox with WireGuard. If you're using OpenVPN, there are some great docs on the Ubuntu website for setting up your own server with OpenVPN.

Once set up, you should be able to issue client certificates and connect to your VPN externally. At the moment, these certificates (and the IP/hostname of your server) will depend on the IP your ISP has given you.

Set up dynamic DNS

Once you've got a VPN setup, you can set up dynamic DNS. Most DDNS will typically run as an agent or other software somewhere on your network, which regularly contacts the dynamic DNS server at scheduled intervals. This allows the server to see the IP address your connection is coming from, and update your DNS records if it's changed.

There are plenty of free dynamic DNS providers, like No-IP, DynDNS, and DuckDNS. We'll be using No-IP since it is a free service.

Firstly, you'll need to create a No-IP account. On their main page, enter a hostname of your choice (it won't matter too much what this is) and click Sign Up. You'll need no details to sign up, but will need to confirm your email. You'll then get a question about why you're using No-IP (there's a skip button in the top right), and the Free plan will be more than sufficient.

Once you're in, go to the Hostnames page, and you should see your previously entered hostname already populated with the IP address you're connecting from.



Once that's done, setup DDNS on your network. Some routers support DDNS natively, in which case you can use No-IP's useful guide to configure your router to automatically ping their servers.

If you're planning on running a DDNS agent elsewhere, we'd suggest using this No-IP docker container. This contains a simple script which, when running, regularly updates No-IP with your IP address. It's small, lightweight, and will run on a Raspberry Pi or similar without issue.

There are also plenty of Windows and Linux based apps that do a similar thing, so we'd suggest doing some research and picking one that best fits your use case.

Test your DDNS

Testing your DDNS can be a little tricky, but we can try it out. First, check your existing IP address and make a note of it. This IP should match the IP configured in No-IP or your DDNS provider. Then, start up your DDNS updater (whether it is on your router, an app on your PC, or running on a server).

Now unplug your router, wait ten minutes, and reconnect it. Once your internet connection is back live, check your IP address again. With any luck, your IP will have changed from the IP you noted down earlier. Within a few minutes, your running agent should register this change, and reflect it in your DNS configuration.

Edit your VPN configuration

A final configuration step is to edit your VPN config to target your new domain name. In some OpenVPN clients (or VPN clients more generally), you can override the hostname or IP address of your config inside the client. If this isn't an option presented to you, you can edit your configuration file. This is as simple as replacing your old IP address with the new hostname of your DDNS.

Dynamic DNS is intended for more advanced users

One thing we should be clear about here is that while dynamic DNS is a powerful way to set up an always available home VPN, simpler options do exist depending on your use case. I make use of OpenVPN personally, as it's highly extensible, has great performance, and makes configuring controlled and extended acces to a wider, multi-location network easier than other tools. But if you're looking for a truly simple setup, there are other services on offer, including potentially the VPN service available through your router.

If you are looking for a more advanced challenge though, or want that full control that running your own VPN manually brings, then DDNS is a great way to solve one of the most annoying problems for those of us with big home networks and no ability to get a static IP.

source