os-ddclient plugin doesn't bind to specified interface

[aaravchen]

I'm on Opnsense 26.7.2_2, and fully up to date.

I have two gateways on my system, one is the regular WAN that's set as the default and is a CGNAT connection from the ISP. The second is a VPN interface that makes a Wireguard connection to a VPS server that has external ports exposed and is configured for port forwarding back to me. I'm configured for incoming traffic on my VPN interface to be NAT routed to a self-hosted server, and no traffic is setup to use that interface by default.

I have the os-ddclient plugin installed and have numerous domain names set to be updated from it so they route to my public server IP address. This is working for updating the addresses on my DNS provider, but the IP addresses it's retrieving are those from my WAN gateway interface rather than my VPN gateway interface. Even though I have all of the entries set to monitor my VPN gateway interface.
I'm running with the default "native" backend, but I've also tried setting it to the deprecated "ddclient" backend and it doesn't seem to matter.

Is there anything I can do to make the ddclient traffic route thru the VPN interface/gateway specifically? Or does the os-ddclient simply not support multi-wan setups (any multi-wan, no matter the priorities, would need the option to specify the exact interface/gateway to bind to)?

[viragomann]

And your VPS has a dynamic IP?

[aaravchen]

Yeah. Also I want to avoid storing a copy of my DNS login credentials on the VPS, which is why I'm not running it from there.

[viragomann]

Running the dynamic DNS client on the VPS would be the best and easiest way, however.

But yeah, if don't want this and your DDNS service just updates your entries with the source IP, which the request is coming from, you should also be able to do this from your home OPNsense and just route the requests over the VPS.

To do this, you have to find out the IP of your DDNS update service.
Then add a static route for this IP and point it to the VPN gateway.
In case, you have not allowed any IP in the VPS Wireguard settings, you will also have add this IP to the allowed ones.

[aaravchen]

I thought about doing that, my DNS provider does support automatically capturing the IP the update request came from. But I hesitated because I couldn't find any way to disable the "what's my IP" query part in the os-ddclient settings. My provider will only use the auto-captured IP if you don't provide it in the body of the request, even if you use the request endpoint that tells it to auto-capture the IP.
It's somewhat reasonable to hard code a static route for sending the requests to my DNS provider, but it won't really work if I have to also hard code a static route for a "what's my IP" provider as well. I'd end up with other issues when a tool or application I was running on my local network happened to try to query one of those popular well known services that are the options in the os-ddclient settings.