1. Noraina Tools
  2. Dynamic IPsec endpoints for Cloudflare WAN

Cloudflare One

Dynamic IPsec endpoints for Cloudflare WAN

Our dynamic IPsec service keeps Cloudflare WAN (formerly Magic WAN) tunnels working at sites whose public IP address changes. When a tunnel degrades, it resolves the site's dynamic DNS name and updates the tunnel's customer endpoint in Cloudflare.

What it does

  • Listens to tunnel health alerts: a Cloudflare WAN tunnel health notification tells the service when a tunnel degrades or recovers.
  • Finds tunnels automatically: tunnels are registered the first time an alert arrives; you only add the dynamic DNS name for sites that need it.
  • Updates the endpoint: while the tunnel is degraded, it checks the DNS name every few minutes and updates the customer endpoint when the IP has changed.
  • Stops when the tunnel is healthy: it checks tunnel health in Cloudflare analytics and stops once the tunnel has recovered, or after 24 hours.

Every degradation, IP change and error is logged, so you can see what happened to each tunnel.

Who it is for

Companies connecting branch offices, shops or small sites to Cloudflare WAN over internet lines without a fixed IP address.

Getting it

We run the service and connect it to your Cloudflare account. Talk to us about your Cloudflare WAN sites.

Independent tools built by Noraina, a Cloudflare Authorized Service Delivery Partner. Not made or operated by Cloudflare. Cloudflare is a trademark of Cloudflare, Inc.

Frequently asked questions

Why does a Cloudflare WAN IPsec tunnel go down when my IP changes?

Each IPsec tunnel in Cloudflare WAN is configured with the public IP address of your end, the customer endpoint. If your internet provider assigns a new address, Cloudflare keeps sending to the old one and the tunnel stays down until someone updates it.

How does the service know the new IP address?

Your router or firewall keeps a dynamic DNS name up to date. When Cloudflare reports the tunnel as degraded, the service resolves that name and, if the address has changed, updates the tunnel's customer endpoint through the Cloudflare API.

What permissions does it need in our Cloudflare account?

An API token limited to your account with read and edit permission on IPsec tunnels, to update the endpoint, and read permission on account analytics, to check tunnel health.

Cloud your way

Talk to us Check your certification