How to Configure Cloudflare DDNS on Zyxel H Series Firewalls

Cloudflare DDNS allows a Zyxel H Series Firewall to automatically update a DNS A record in Cloudflare when its public WAN IP address changes. This feature is useful when a firewall has a dynamic public IP address but services such as VPN, remote access, Captive Portal, or other Internet-facing services need to be accessed using a consistent FQDN. The Cloudflare DDNS integration uses the Cloudflare API with an API Token and Zone ID to securely update the DNS record.

Requirements

Before configuring Cloudflare DDNS on the Zyxel H Series Firewall, prepare the following:

• A Cloudflare account with the required domain added as a Cloudflare zone.
• The Zone ID of the Cloudflare zone.
• A Cloudflare API Token with DNS Write permission for the required zone.
• An A record for the hostname that will be updated by the firewall.
• The hostname/FQDN of the A record.

Cloudflare recommends using API Tokens for API authentication and provides the Edit Zone DNS template with the DNS Write permission. The token can also be restricted to a specific zone.

For detailed instructions, refer to the official Cloudflare documentation:

• Find account and zone IDs
• Create an API token
• Create and manage DNS records

Note: The Cloudflare DDNS provider is available on H Series Firewalls running uOS 1.39 or later.

Get the Zone ID

1. Log in to the Cloudflare dashboard.
2. Open the required domain.
3. On the Overview page, scroll down to the API section.
4. Under Zone ID, select Click to copy.

5. Click Create Token.

Create a Cloudflare API Token

Under API token templates, select Edit zone DNS and click Use template. Enter a descriptive Token name, for example Zyxel H Series DDNS. Under Permissions, keep:

• Zone → DNS → Edit

Under Zone Resources, select:

• Include → Specific zone → your Cloudflare zone.

Leave Client IP Address Filtering and TTL unchanged unless additional restrictions are required. 

Click Continue to summary and verify that the token has DNS: Edit permission for the required zone.

Click Create Token.

Important: Cloudflare displays the API Token only once after it is created. Copy and securely store the token before leaving the page. If the token is exposed or compromised, use Roll to generate a new token and invalidate the previous one.

Create an A Record in Cloudflare

Before configuring DDNS on the firewall, create an A record for the hostname that will be used for DDNS.

1. In the Cloudflare dashboard, open DNS → Records.
2. Click Add record.
3. Set Type to A.
4. Enter the required hostname in Name, for example:
   h200
5. Enter a temporary WAN IPv4 address in IPv4 address.
6. Set Proxy status to DNS only.
7. Leave TTL set to Auto.
8. Click Save.

Configure Cloudflare DDNS on the H Series Firewall

1. Log in to the H Series Firewall Web GUI.
2. Go to System → DNS & DDNS → DDNS.
3. Enable the DDNS profile.
4. Enter a Profile Name.
5. Set DDNS Type to Cloudflare.
6. Under DDNS Account, enter:
   • Zone ID — the Zone ID of your Cloudflare zone.
   • API_Token — the Cloudflare API Token created for DNS editing.
7. Under DDNS Setting, enter the Domain that corresponds to the Cloudflare A record, for example:
   H200.zylab.uk
8. Under Primary Address, select the WAN interface used for the Internet connection.
9. Select Interface as the IP address source.
10. Leave Backup Address set to none unless a backup WAN interface is required.
11. Leave the Advanced Settings at their default values.
12. Click Apply to save the configuration.

The Cloudflare DDNS configuration requires the Zone ID, API Token, and Domain name.

Example

For the test configuration:

After saving the configuration, the firewall uses the Cloudflare API to retrieve and update the DNS record with the current WAN IP address.

Verification

After configuring Cloudflare DDNS on the USG FLEX H Series firewall, verify that the configured FQDN can be used to access the firewall services.

Note: The DDNS configuration keeps the Cloudflare DNS record synchronized with the firewall's public IP address. Therefore, when the public IP changes, the FQDN can continue to be used without manually changing the VPN or HTTPS configuration.

1. Verify HTTPS access

Open the firewall Web Configurator using the configured FQDN:

https://h200.zylab.uk

The Web Configurator should be accessible through the FQDN.

This confirms that the Cloudflare DNS record resolves to the firewall's current public IP address.

2. Verify Remote Access VPN

Configure the Remote Access VPN client to use:

h200.zylab.uk

as the VPN server address.

Establish the VPN connection and verify that the client can access the configured network resources.

This confirms that the DDNS hostname can be used for Remote Access VPN instead of a static public IP address.