We have an OpenVPN server that clients connect to using X509 certificates. Some clients that connect to it get a random IP using its DHCP server, while others have a user config file that says something like:


which essentially sets that client to always have the same IP when it connects.

What we've done in the past is have some iptables firewall rules that say things like

if the source IP is, allow it access to servers X and Y only

My question is this: is that effective at all as a means of access control? Or can a client just override the IP the OpenVPN DHCP server gives them with a static IP whenever they feel like, as long as it's not already taken, and on the same subnet?

If they can change their IP, I guess the solution would be to create multiple instances of OpenVPN servers, and setup iptables rules based on the interface (tun0, tun1, etc), rather than individual IPs? Or is the way we're doing it now fine, and the OpenVPN server will prevent them from changing their IP?


This would be security through obscurity. Apparently there are ways for a client to override their IP, and while you might be able to security in theory, there are a lot of moving parts.

Here's a post on OpenVPN forums about clients overriding their IPs: https://forums.openvpn.net/viewtopic.php?t=22598

So, it would be effective until someone figured it out. However, if someone gets on the wire between OpenVPN and the private server, they have access. Your best bet would probably be to block obviously bad IPs to prevent brute forcing and DoS, but rely the server for authentication.

If the server is untrustworthy or doesn't have options for authentication, you could use OpenVPN to secure it, but I would make one OpenVPN server per private server and I wouldn't allow other traffic on the wire(direct, or private VLAN) between them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.