Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any way to forcefully limit OpenVPN client's addresses?

I.e. for each of multiple clients (identified by certificates) offer a specific IP address and disallow it to use any other.

It (something at least) has to be done on OpenVPN level itself, since there seems to be no differentiation between clients on the tap interface on server, but I can't find anything appropriate.

share|improve this question

1 Answer 1

There is a good section on this in the OpenVPN documentation: Configuring client-specific rules and access policies.

share|improve this answer
    
As I understand, that configuration doesn't disallow a particular OpenVPN client to change own IP address to something different from what was offered to it with ifconfig-push. Or I'm missing something else? –  HoverHell Nov 11 '10 at 3:17
    
If the client changes its own IP address, the server will not notice, and packets will not be routed back to it. (AFAIK) –  Zanchey Nov 11 '10 at 3:24
    
Packets get successfully routed if client changes own IP address; also, ifconfig-push in ccd is seen as “suggested” address, and there are cases when it can allocate a different one (probably in the case of sudden reconnect). –  HoverHell Nov 11 '10 at 16:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.