Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So, I have the following question: Given a server with public (routable) ip's, let's say: x.y.z.1, x.y.z.2, x.y.z.3 - x.y.z.31, I want to configure OpenVPN as a proxy or masquerade server for some clients as follows: each client has a unique public static ip address: a.b.c.d. He will connect to the allowed server address: x.y.z.1 (he shall not be able to connect to any other public ip address of the server). Using this connection, he should be able to browse the internet having the public ip address to which he connected in the first place, say x.y.z.1. This setup is trivial using only Squid (attached for the ones who need it) but I must find a way to do this whole shebang using OpenVPN.

acl testuser1src src a.b.c.d # this is the client's public ip address

acl testuser1bindip myip x.y.z.1 # one of the server's public ip addresses

tcp_outgoing_address x.y.z.1 testuser1bindip

http_access allow testuser1src testuser1bindip # if the two conditions are fulfilled OK

Thanks in advance

share|improve this question

Where "" is the client's OpenVPN-assigned address and, "" is the public IP address to SNAT the client's traffic to/from:

iptables -t nat -A POSTROUTING -s -j SNAT --to-source

That's doing what you want on a test box of mine here. Obviously, you'll need OpenVPN setup with client configuration files to dole out the same IP address to a given client when they connect, but it sounds like you've got that already.

If you don't already have an entry in your FORWARD chain to allow the traffic from the clients through you'll want to add a rule there, too. You could do something like this if you want to blindly forward traffic received on a tunnel interface bound for the Internet:

iptables -A FORWARD -i tun+ -o internet-interface -j ACCEPT

Finally, if you want to direct unsolicited inbound connection attempts for the clients' public IP addresses to the clients you'll want to do that on the PREROUTING chain in the nat table with something like:

iptables -t nat -I PREROUTING -d -j DNAT --to-dest
share|improve this answer

You can use the ipp.txt file on openvpn server so it assigns only the IP you want to each client. On default, ipp.txt is maintained by openvpn server but you can change that so you maintain it using the following line in your server config file (openvpn will not update ipp.txt anymore):

ifconfig-pool-persist /path/to/ipp.txt 0 on the server config (just adding 0 at the end of the default line).

The file is in the form host,ip.

share|improve this answer
Thank you very much, that's exactly what I was looking for. And you say that if i do something like: client1, client2, in ipp.txt client1 and 2 will always be given these addresses? I'll try that and get back to you. Anyway, thanks alot :D – R.C. Jul 19 '10 at 8:26
yes, each one on a different line and disabling openVPN from updating the file with the 0 in config file. – laurent Jul 19 '10 at 13:02

Thanks for the quick reply, Evan. However, SNAT-ing and DNAT-ing are not the issue here. Let me get a real life example to show you exactly what I want:

We have two clients, each with a unique public IP: client1: and client2: The server has the ip addresses: - First of all, I want to assign each of the clients one (and only one!!!) public IP address from my server, IP address they will use to mask themselves on the internet.

client1( ---> client2( --->

We setup OpenVPN with the least configuration possible: a static key shared amongst all clients:

Server configuration file dev tun server secret static.key Client1 configuration file remote dev tun ifconfig secret static.key Client2 configuration file remote dev tun ifconfig secret static.key

I can, of course, limit Client1 to connect only to and Client2 to connect only to, but how do I prevent them from switching tunnel ip's? I mean, client1 can easily modify the .ovpn file so that it sais: ifconfig, thus interfering with client2. This will render the SNAT-DNAT rules useless. That's my dilemma, how do I link the client's public ip to the tunnel ip seen on the server side (to only the address can be used internally on the ovpn tun interface, and can connect only to

Thanks, R.C.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.