TIL that I cannot have 2FA enabled for my no-ip.com account, because then my router can't access it to update my WAN IP when it changes.
I had been wondering why my Wireguard tunnels suddenly stopped working, and it was because my DDNS address was still on the old IP.
So either I disable 2FA on my no-ip account, or I have to manually log into the account and change the IP every time there's a change. Which kind of defeats the purpose of dynamic DNS address.