Alright, so I'm using OpenVPN on ubuntu 14.04. Say I have a box, with 5 IPs, I have openvpn, but I want to make 5 different client certificates and .ovpn files, but each of those certificates will have a different ip, so client1 will have the first ip, client2 will have the second IP, and so forth, or some kind of method that makes SURE that each client gets their OWN IP address out of the 5 and that no two clients are going to be using the same IP address. The IPs I have right now to use are

This applies to a routed network, not bridged (otherwise just configure the DHCP server).

You should use the client-config-dir option on the server. You have to supply a directory that has a per-client configuration file. The name of the file should be the same as the name of the certificate (ie. the name of the certificate supplied to easy-rsa). Then you can specify options to be used for each client (you can think of it as a "static DHCP", though there are many other options that can be configured for a particular client, not just the IP address).

For example (you can use comments in those files):

#first is client address, second is netmask
  • Would the be the external ip? – Kaveen K Mar 20 '16 at 1:55
  • No, it is the client IP inside the VPN. – filo Mar 20 '16 at 15:55
  • How would I make that client IP go to a public external ip then? – Kaveen K Mar 20 '16 at 23:55
  • Do you want to assign external public IP addresses to some VPN clients? Then you need to allocate them addresses from a private pool, assign all public addresses to the server and configure iptables forwarding to from public addresses to addresses within the VPN. – filo Mar 21 '16 at 6:08

You can do that using /etc/openvpn/ipp.txt file

Basically you need to add (one line per client):


for example in my case i got:



Route the internals to an external through the respective NAT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.