How to create a site to site VPN when local network has dynamic public IP

Question

How to create a site to site VPN when local network has dynamic public IP

local network router is on cellular network, cannot get a static IP.

cant use DNS (for reasons..)

i know a number of solutions allow site-to-site VPNs from an unknown IP, but does Azure VPN allow this?

Answer 1

@Colm

Welcome to the Microsoft Q&A forum.

As the on-prem public IP address will dynamically change in your case, the recommended approach here is to create a Local Network Gateway for your Azure VPN using a FQDN and then use a constant DNS name with a Dynamic DNS service to point to your current public IP address of your VPN device. Your Azure VPN gateway will resolve the FQDN to determine the public IP address to connect to. This is currently documented here.

As you mentioned you cannot use DNS in your set-up, another approach you can try here is to update the Local Network Gateway's IP address as soon as on-prem device's IP address is updated. You can do this programmatically, where you can have script monitoring the on-prem public IP address and if it changes you can perform a Rest API call or execute a PowerShell command to update the Local Network Gateway's IP address. If you plan to follow this method, please be aware that making changes to a local network gateway that has a connection may cause tunnel disconnects and downtime.

Hope this helps! Please let me know if you have any questions. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.