I've setup an OpenVPN server on Windows, all is working fine. I want to have my OpenVPN clients connect with a predetermined IP address. With reading/research I understand this is pushed out via a file in the CCD folder on the server.

My question is rather simple: In the OpenVPN/Config/CCD directory, what is the file extension for the "file" that gets created. No tutorial specifies.

user1.?? user2.??



There is no file extension, the filename should simply match the name from the Common Name (CN) in the certificate presented by the client.

Ie, if the CN is foo, the filename is foo.

See the CCD section in the manual:

--client-config-dir dir
Specify a directory dir for custom client config files. After a connecting client has been authenticated, OpenVPN will look in this directory for a file having the same name as the client's X509 common name. If a matching file exists, it will be opened and parsed for client-specific configuration options. If no matching file is found, OpenVPN will instead try to open and parse a default file called "DEFAULT", which may be provided but is not required. Note that the configuration files must be readable by the OpenVPN process after it has dropped it's root privileges.

This file can specify a fixed IP address for a given client using --ifconfig-push, as well as fixed subnets owned by the client using --iroute.

One of the useful properties of this option is that it allows client configuration files to be conveniently created, edited, or removed while the server is live, without needing to restart the server.

The following options are legal in a client-specific context: --push, --push-reset, --push-remove, --iroute, --ifconfig-push, and --config.

  • I've created a no-file extension file in CCD, named it the same as the CN of the client connecting, in this I have ifconfig-push (which is the address I want it to have on my VPN's network), I then restart the service and check ipconfig and still connects with it's DHCP lease of :S – UniqueTurbo Jul 8 '18 at 12:16
  • @UniqueTurbo When you say "DHCP lease" do you mean that you've arranged to literally use the DHCP protocol over an L2 tunnel (ie tap) or just the normal OpenVPN address assignment (ie based on server / ifconfig-pool, ifconfig-push)? – Håkan Lindqvist Jul 9 '18 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.