Go to Njalla and create your dynamic DNS record. Once you do that It should show you something like this: https://njal.la/update/?h=<yourSubdomain>&k=<yourKey>&auto On your records page it will fill in your subdomain and key automatically. on their documentation page it does not do this. You don't need the one from the documentation page. the one next to your dynamic DNS entry is what we want anyways. Now on the pfSense box: Make a new Dynamic DNS client. Service Type: Custom Interface to monitor: WAN (but might be something else depending on what you are doing) Interface to send update from: WAN (but might be something else depending on what you are doing) In the update URL box paste in the URL Njalla gave you. In the result Match paste in this: {"status": 200, "message": "record updated", "value": {"A": "%IP%"}} Now your pfsense box should know if it did a successful update or not. In your pfsense Status > System logs you should see this: /services_dyndns_edit.php: phpDynDNS (): (Success) IP Address Updated Successfully! Then I ran into an issue where it seemed like njalla wanted an update sooner than every 25 days and pfsense would say oh it hasn't been 25 days so I'm not telling njalla my IP is the same. well ok then. I pulled some inspiration from this thread: https://www.reddit.com/r/PFSENSE/comments/hhvxdl/force_dynamic_dns_update_every_7_days/ So thanks u/WetwareLabs I installed the cron package on the pfsense box and then I edited the /usr/bin/nice -n20 /etc/rc.dyndns.update command to run on the 1 minute of every hour (I think you see where this is going). I then created a new cron to run every hour on the 0 minute that just runs this command: rm /cf/conf/dyndns\_wancustom\\'\\'0.cache So now every hour the firewall doesn't have the current WAN IP cached and he goes "Holy barnacles, I gotta tell Njalla my new IP!" Now Njalla knows every 1 hour that something is still saying "hey I'm alive and here is my IP" I know this solution is kind of ugly, but it works. I am sure almost nobody will read this or do anything with it but if you are living the real privacy lifestyle running local nextcloud and want to get at that sucker from the internet AND you don't want to pay for a static IP or use another dynamic DNS provider then maybe this is for you.

I’ve been tooling around with this for a few days now and I think I stumbled into a couple pretty useful things. 1.) having multiple VPN destinations with proton (because proton wont just load balance you to country specific plus servers): If you already have a working openvpn config you can go to the custom options and add this to it at the bottom: remote x.x.x.x 1194; remote y.y.y.y 1194; remote-random; where x.x.x.x and y.y.y.y are different proton VPN IPs or DNS names. I picked plus servers because for some reason proton doesnt have us-plus.protonvpn.com or any country based DNS entry that just does that for you. I was manually changing VPN IPs when each one would go down for maintenance and that got old quick. 2.) Split DNS Maybe you want to have your firewall do DNS lookups for VPN tunnel establishment and then have your clients route their DNS through the tunnel to 10.8.8.1 to stream BUT you need your pfsense box to be the DNS option because you have a host override entry for local resolution of a public DNS entry (nextcloud would be a prime example). System > General Setup add your external DNS servers here (1.1.1.2 and 1.0.0.2 for me). Check box for Disable DNS forwarder and uncheck DNS server Override Then go to Services > DNS Resolver Enable DNS resolver For outgoing Network interfaces you will want your VPN interface probably uncheck Use SSL/TLS for outgoing DNS Queries but this will depend on your DNS server you are putting in there In custom options (if you are using UDP: server: forward-zone: name: “.” forward-addr: 10.8.8.1@53 Hopefully that made sense and is useful to at least one person out there and you don’t need to struggle like I did. Or maybe everyone here is a pfsense guru and i’m just repeating the obvious.