Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to forcefully limit OpenVPN client's addresses?

I.e. for each of multiple clients (identified by certificates) offer a specific IP address and disallow it to use any other.

It (something at least) has to be done on OpenVPN level itself, since there seems to be no differentiation between clients on the tap interface on server, but I can't find anything appropriate.

share|improve this question

There is a good section on this in the OpenVPN documentation: Configuring client-specific rules and access policies.

share|improve this answer
As I understand, that configuration doesn't disallow a particular OpenVPN client to change own IP address to something different from what was offered to it with ifconfig-push. Or I'm missing something else? – HoverHell Nov 11 '10 at 3:17
If the client changes its own IP address, the server will not notice, and packets will not be routed back to it. (AFAIK) – Zanchey Nov 11 '10 at 3:24
Packets get successfully routed if client changes own IP address; also, ifconfig-push in ccd is seen as “suggested” address, and there are cases when it can allocate a different one (probably in the case of sudden reconnect). – HoverHell Nov 11 '10 at 16:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.