Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a firewall linux box with 4 interfaces:

eth0 (to the internet) eth1 (Employee subnet) eth2 (Guest subnet) eth3 (Management subnet)

And I am trying to setup the openvpn server and client in such a way that he connects the client to the right subnet while checking the CN in the certificate.

In such a way:

Employee -> subnet (Employee subnet) Guest -> subnet subnet) Admin -> subnet (Management subnet)

How can I do that?

share|improve this question
up vote 0 down vote accepted

Take a look at the following settings in the man page:

   --client-config-dir dir


From there, you can create CCD files specific to the CNs of the certificates, and push different subnets, routes (or any other config settings you like) to the client based on it. The second option specifies that no connection is allowed unless a CCD exists for that CN.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.