For openvpn there is a switch called
--learn-address, that can be used to generate rules...
In this script you basically you check the CN and add/remove iptables rules for the IP.
extract from the openvpn MAN:
Run script or shell command cmd to validate client virtual
addresses or routes.
cmd will be executed with 3 parameters:
 operation -- "add", "update", or "delete" based on whether
or not the address is being added to, modified, or deleted from
OpenVPN's internal routing table.
 address -- The address being learned or unlearned. This can
be an IPv4 address such as "22.214.171.124", an IPv4 subnet such
as "126.96.36.199/24", or an ethernet MAC address (when --dev tap
is being used) such as "00:FF:01:02:03:04".
 common name -- The common name on the certificate associated
with the client linked to this address. Only present for "add"
or "update" operations, not "delete".
On "add" or "update" methods, if the script returns a failure
code (non-zero), OpenVPN will reject the address and will not
modify its internal routing table.
Normally, the cmd script will use the information provided above
to set appropriate firewall entries on the VPN TUN/TAP inter‐
face. Since OpenVPN provides the association between virtual IP
or MAC address and the client's authenticated common name, it
allows a user-defined script to configure firewall access poli‐
cies with regard to the client's high-level common name, rather
than the low level client virtual addresses.