Handle Cloudflare's proxied IP addresses #65

New Issue

saavagebueno · 2025-11-20T04:19:41-05:00

saavagebueno commented

2025-11-20 04:19:41 -05:00

Originally created by @itsikg on GitHub (Sep 27, 2020).

Originally assigned to: @qdm12 on GitHub.

What's the feature?
Cloudflare allows creating DNS records that will be "masked" (proxied) from the public. When pinging or nslookup the host name, the results will not contain the actual IP address but proxies.
It seems the updater is not aware of that and each cycle it discovers that it has a different IP address than the one on the DNS and triggers a record update. This happens every 5 minutes and could cause a ban / block from the provider.
I suggest using a different method to check for an IP change. I assume using Cloudflare's API might help.
Why do you need this feature?
To reduce the IP change requests from the provider.
Extra information?
For the same reason, I had to use "no_dns_lookup" because the healthcheck kept reporting "unhealthy"...
Attaching an image of Cloudflare's A record format.

Originally created by @itsikg on GitHub (Sep 27, 2020). Originally assigned to: @qdm12 on GitHub. 1. What's the feature? Cloudflare allows creating DNS records that will be "masked" (proxied) from the public. When pinging or nslookup the host name, the results will not contain the actual IP address but proxies. It seems the updater is not aware of that and each cycle it discovers that it has a different IP address than the one on the DNS and triggers a record update. This happens every 5 minutes and could cause a ban / block from the provider. I suggest using a different method to check for an IP change. I assume using Cloudflare's API might help. 2. Why do you need this feature? To reduce the IP change requests from the provider. 3. Extra information? For the same reason, I had to use "no_dns_lookup" because the healthcheck kept reporting "unhealthy"... Attaching an image of Cloudflare's A record format. ![image](https://user-images.githubusercontent.com/60376664/94363366-6d2d2100-00ca-11eb-8e01-671ebfb3fd58.png)

saavagebueno closed this issue

2025-11-20 04:19:41 -05:00

saavagebueno commented

2025-11-20 04:19:41 -05:00

@qdm12 commented on GitHub (Sep 27, 2020):

Indeed, thanks for reporting the issue!

Can you please try with qmcgaw/ddns-updater:nolookup-update see if it works?

Doing an API call to list the records would still do an API call every n minutes, which is not ideal.
Instead I just use the last IP stored in the json file to see if the public IP address changed.

It should work, but let me know if you encounter any problem 😉

@qdm12 commented on GitHub (Sep 27, 2020): Indeed, thanks for reporting the issue! Can you please try with `qmcgaw/ddns-updater:nolookup-update` see if it works? Doing an API call to list the records would still do an API call every n minutes, which is not ideal. Instead I just use the last IP stored in the json file to see if the public IP address changed. It should work, but let me know if you encounter any problem 😉

saavagebueno commented

2025-11-20 04:19:42 -05:00

@itsikg commented on GitHub (Sep 27, 2020):

Wow, that was fast 😀
I relaunched the container using the new branch and it is now working as expected. No IP change was triggered since the public IP has not changed.
Thank You 👍

@itsikg commented on GitHub (Sep 27, 2020): Wow, that was fast 😀 I relaunched the container using the new branch and it is now working as expected. No IP change was triggered since the public IP has not changed. Thank You 👍

saavagebueno commented

2025-11-20 04:19:42 -05:00

@qdm12 commented on GitHub (Sep 27, 2020):

Alright perfect! Merging it now! And also thanks for the Paypal donation 🥇

@qdm12 commented on GitHub (Sep 27, 2020): Alright perfect! Merging it now! And also thanks for the Paypal donation 🥇

saavagebueno commented

2025-11-20 04:19:42 -05:00

@jt196 commented on GitHub (Nov 14, 2020):

@qdm12 I'm experiencing a similar problem with a similar set up. Cloudflare, proxied. Weirdly I'm only getting an error message for one of the subdomains, not the others. I can't figure out what is different about it.

2020-11-14T15:33:15.911Z	WARN	unhealthy: lookup IP addresses for _subdomain.domain.co.uk_ are _cloudflare_IP, ,cloudflare_IP2,IPv6 address,IPv6_address,,IPv6 address_ instead of _my_ipaddress_

The DDNS-updater also seems to update subdomains (not the wildcard) that don't need their IP addresses updating.

I've tried using the image you recommended but the problem persists.

This is the structure of my json config file:

            "provider": "<cloudflare>",
            "zone_identifier": "<zone_id>",
            "domain": "<domain.co.uk>",
            "host": "<subdomain>",
            "ttl": 1,
            "token": "<token>",
            "proxied": true,
            "ip_version": "ipv4"
        },

I've put an entry for each of the subdomains that I have on the DNS records, not sure if that's correct but I had to do this to get my certs working.

@jt196 commented on GitHub (Nov 14, 2020): @qdm12 I'm experiencing a similar problem with a similar set up. Cloudflare, proxied. Weirdly I'm only getting an error message for one of the subdomains, not the others. I can't figure out what is different about it. ``` 2020-11-14T15:33:15.911Z WARN unhealthy: lookup IP addresses for _subdomain.domain.co.uk_ are _cloudflare_IP, ,cloudflare_IP2,IPv6 address,IPv6_address,,IPv6 address_ instead of _my_ipaddress_ ``` The DDNS-updater also seems to update subdomains (not the wildcard) that don't need their IP addresses updating. I've tried using the image you recommended but the problem persists. This is the structure of my json config file: ``` "provider": "<cloudflare>", "zone_identifier": "<zone_id>", "domain": "<domain.co.uk>", "host": "<subdomain>", "ttl": 1, "token": "<token>", "proxied": true, "ip_version": "ipv4" }, ``` I've put an entry for each of the subdomains that I have on the DNS records, not sure if that's correct but I had to do this to get my certs working.

saavagebueno commented

2025-11-20 04:19:42 -05:00

@qdm12 commented on GitHub (Dec 6, 2020):

Weirdly I'm only getting an error message for one of the subdomains, not the others. I can't figure out what is different about it.

I think you need to add "no_dns_lookup": true to that subdomain so the healthcheck doesn't try to resolve it.

The DDNS-updater also seems to update subdomains (not the wildcard) that don't need their IP addresses updating

For now the program sends 2 http requests (together with auth headers):

Get the identifier from https://api.cloudflare.com/client/v4/zones/<zone-identifier>/dns_records?type=A&name=subdomain.domain.com&page=1&per_page=1
Send a PUT request to https://api.cloudflare.com/client/v4/zones/<zone-identifier>/dns_records/<identifier> with body
```
{"type":"A","name":"subdomain","content":"yourip","proxied":true,"ttl": <your-ttl>}
```

HOWEVER It seems the "name" value should be subdomain.domain.com, so I just changed that. Please wait for the build to finish, pull :latest again and try to see if it solves it?

I also wanted to apologize for the inconvenience and the delay in answering 😉

@qdm12 commented on GitHub (Dec 6, 2020): > Weirdly I'm only getting an error message for one of the subdomains, not the others. I can't figure out what is different about it. I think you need to add `"no_dns_lookup": true` to that subdomain so the healthcheck doesn't try to resolve it. > The DDNS-updater also seems to update subdomains (not the wildcard) that don't need their IP addresses updating For now the program sends 2 http requests (together with auth headers): 1. Get the identifier from `https://api.cloudflare.com/client/v4/zones/<zone-identifier>/dns_records?type=A&name=subdomain.domain.com&page=1&per_page=1` 1. Send a PUT request to `https://api.cloudflare.com/client/v4/zones/<zone-identifier>/dns_records/<identifier>` with body ```json {"type":"A","name":"subdomain","content":"yourip","proxied":true,"ttl": <your-ttl>} ``` **HOWEVER** It seems the `"name"` value should be subdomain.domain.com, so I just changed that. Please wait for the [build to finish](https://github.com/qdm12/ddns-updater/actions/runs/404639771), pull `:latest` again and try to see if it solves it? I also wanted to apologize for the inconvenience and the delay in answering 😉

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ddns-updater#65