Is there any way to forcefully limit OpenVPN client's addresses?

I.e. for each of multiple clients (identified by certificates) offer a specific IP address and disallow it to use any other.

It (something at least) has to be done on OpenVPN level itself, since there seems to be no differentiation between clients on the tap interface on server, but I can't find anything appropriate.

1 Answer 1


There is a good section on this in the OpenVPN documentation: Configuring client-specific rules and access policies.

  • As I understand, that configuration doesn't disallow a particular OpenVPN client to change own IP address to something different from what was offered to it with ifconfig-push. Or I'm missing something else?
    – HoverHell
    Commented Nov 11, 2010 at 3:17
  • If the client changes its own IP address, the server will not notice, and packets will not be routed back to it. (AFAIK)
    – Zanchey
    Commented Nov 11, 2010 at 3:24
  • Packets get successfully routed if client changes own IP address; also, ifconfig-push in ccd is seen as “suggested” address, and there are cases when it can allocate a different one (probably in the case of sudden reconnect).
    – HoverHell
    Commented Nov 11, 2010 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .