For a multiclient OpenVPN configuration, as we can find from the relevant documentation (server.conf comments),

Configure server mode and supply a VPN subnet for OpenVPN to draw client addresses from. The server will take for itself, the rest will be made available to clients. Each client will be able to reach the server on


So, as we understand, we are actually assigning a pool 256 addresses, the first usable address being and the last usable should be Among these, the first of the addresses ( will be assigned to the server, as already made explicit in the above text.

Also, in the client configuration file, we find something like,

The hostname/IP and port of the server. You can have multiple remote entries to load balance between the servers.

remote my-server-1 1194

Where, the last line, as I deduce, should be written as,

remote 1194

in order to match with the server address.

(This statement is not correct, see this answer.)

Now, my question is, which algorithm does the sever follow in order to assign addresses to the client from the pool of available addresses (

Is it something like that the first client gets the .2 address, the next one .3 address? Or is it that addresses are assigned at random? Or is it something else, if it is .5, 9., why is it like that?

1 Answer 1


OpenVPN doesn't document the exact algorithm it uses to find free addresses in the pool because it's an implementation detail and it doesn't really matter as long as it's a free address. Nevertheless, you can see what algorithm it uses by looking at the function ifconfig_pool_find in pool.c:

  • If in duplicate_cn mode, take the first free address.
  • If the IP address previously used by the same client is still free, select it.
  • Otherwise, pick the least recently used free address from the pool.

As for your other question:

remote 1194

No, you definitely shouldn't use that as the remote address. Since you try to reach the tunnel server through the tunnel itself and the tunnel isn't set up yet at this point (during initialization) you cannot contact the server. If you somehow could establish the tunnel, you'd then have a routing loop.

In order to establish the tunnel, you need to have an IP address on which you can contact the other endpoint of the tunnel without benefit of the tunnel. This would normally be a reachable public Internet address for that endpoint. That's what you have to give for remote.

  • So, does that mean the clients will have addresses like .2, .3 or some such as decided by the server? In some setup, why did I get .5 as the first client address?
    – Masroor
    Commented May 2, 2015 at 13:39
  • I don't know why you got .5 as the first address, but... why does it matter?
    – Celada
    Commented May 2, 2015 at 13:41
  • It mattered for me because I was wondering why .5 was assigned instead of .2. Thanks anyway.
    – Masroor
    Commented May 2, 2015 at 13:48
  • 1
    Perhaps my ignorance shows, but your answer seems to be a bit off the track from this one, community.openvpn.net/openvpn/wiki/…?
    – Masroor
    Commented May 2, 2015 at 15:25
  • Ah, I forgot about that configuration because I don't use it! I'm sorry about that. Yeah, allocating in units of /30 explains why the first address handed out would be .5. It also wastes 3 IP addresses per client.
    – Celada
    Commented May 2, 2015 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .