---
title: 'Tutorial: Restrict by IP address with the Post-Auth IP Restrict Script'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--post-auth-ip-restrict/
product: Access Server Docs
description: How to use Access Server's post-auth programming hook to restrict users by IP addresses with a Python script.
---

# Tutorial: Restrict by IP address with the Post-Auth IP Restrict Script

## Overview

Access Server's post-auth programming hook allows you to extend Access Server's possibilities for authenticating against a source of credentials. This document provides examples for creating a post-auth script that restricts users based on their IP addresses.

### Authentication and the post-auth script role

#### Access Server's authentication system

Access Server supports several robust authentication systems without using a post-auth script — whether you manage it from the Admin Web UI or authenticate against a third-party system. These are the systems already supported:

1. **[Local](https://openvpn.net/as-docs/local.md):** Access Server's built-in authentication system storing user credential hashes in the user properties database, with management handled in the Admin Web UI.
2. **[PAM](https://openvpn.net/as-docs/pam.md):** Linux system that requires console management or an SSH session on the OS.
3. **[LDAP](https://openvpn.net/as-docs/ldap.md):** Once you set up the connection in the Admin Web UI, Access Server can authenticate against an LDAP server.
4. **[RADIUS](https://openvpn.net/as-docs/radius.md):** Once you set up the connection in the Admin Web UI, the Access Server can authenticate against a RADIUS server.
5. **[SAML](https://openvpn.net/as-docs/saml.md):** Once you set up the connection in the Admin Web UI, Access Server can use SAML single sign-on (SSO) by authenticating through an identity provider (IdP).

For more information about these authentication methods, refer to this detailed topic: [Authentication System](https://openvpn.net/as-docs/user-authentication-system.md).

#### The post-auth script process

1. The user signs in with a VPN client or on the Client Web UI.
2. They successfully authenticate with their credentials.
3. The post-auth script runs (hence, post-auth — after authentication).

The post-auth script is a text file written in Python. It can do all sorts of interesting things, like automating user group assignment based on specific criteria, implementing a custom authentication system, adding an extra filter to the login process, or checking the user device's hardware address.

## Prerequisites

- An [installed Access Server](https://openvpn.net/as-docs/installation.md).
- Python script knowledge.
- Root access on the server.

## Step 1: Understand how the IP restrict script works

You can create an IP restriction script to enhance the security of your authentication by registering an IP address to a user and restricting that user's access to the registered IP address.

Our sample script automatically registers an IP address for a user upon their first authentication and restricts their access to the registered IP address. They're denied access if they sign in from a new IP address. The post-auth script learns and locks the IP address for a user who doesn't already have one registered.

> **Note**
>
> Optionally, you can register IP addresses manually. We provide the steps for that in the [optional section below](https://openvpn.net/as-docs/tutorials/tutorial--post-auth-ip-restrict/#optional--manually-register-ip-addresses).

### From a user perspective

When a new user signs in and you're using the default settings for this post-auth script, here's the process:

1. The new user signs in with valid credentials.
   - Their IP address isn't in your Access Server's user properties database.
2. Access Server learns and locks the user's IP address.
3. The next time the user signs in, their IP address must match the value stored in the user properties database.

## Step 2: Install/update the script

1. Sign in through SSH or your Access Server server console.
2. Obtain root privileges.
3. Retrieve the example Python script from our website (https://packages.openvpn.net/as/scripts/post\_auth\_ip\_address\_checking.py):

   ```
   wget https://packages.openvpn.net/as/scripts/post_auth_ip_address_checking.py -O /root/ip.py
   ```

   This saves the script to the **/root/** directory with the name **ip.py**.

   > **Tip**
   >
   > If you have problems downloading the script this way, you may need to install/update the **wget** and/or **ca-certificates** package(s) on your system.
4. (Optional) Edit the script for your specific needs:

   ```
   nano /root/ip.py
   ```

   - Make your changes to the script, then save and exit.
5. Load the script into the Access Server configuration and reload Access Server:

   ```
   cd /usr/local/openvpn_as/scripts
   ./sacli --key "auth.module.post_auth_script" --value_file=/root/ip.py ConfigPut
   ./sacli start
   ```

> **Important**
>
> When you change the **ip.py** file, you must use the above commands to load the script again and reload Access Server.

## Optional: Uninstall the script

After you’ve loaded the script into the configuration database, you can remove it, if needed, using the following commands.

```
cd /usr/local/openvpn_as/scripts
./sacli -k auth.module.post_auth_script ConfigDel
./sacli start
```

> **Note**
>
> This action doesn't remove the IP addresses already saved in the database, but Access Server will ignore these. You can clean those up manually if you wish with the **sacli** command, and we provide instructions for that in the next section.

## Optional: Unregister or reset an IP address

If the user account is being used from another IP address or the IP address has changed, you need to remove the IP address stored and locked for that particular user. You can use the following commands to remove the saved value for the user "exampleuser" and reload the server.

Remove saved IP address for **exampleuser**:

```
cd /usr/local/openvpn_as/scripts
./sacli -u "exampleuser" -k "pvt_clientip" UserPropDel
./sacli start
```

## Optional: Manually register IP addresses

If you want to register IP addresses manually, you can turn off the automatic IP address registration and then manually register them from the command-line interface.

1. Open the script for editing:

   ```
   nano /root/ip.py
   ```
2. Edit the `first_login_ip_address` parameter and set it to NONE or DISABLED (either works fine):

   ```
   first_login_ip_addr = "NONE"
   ```

   or

   ```
   first_login_ip_addr = "DISABLED"
   ```
3. Save and exit the script.
4. Reload the script and restart the Access Server service:

   ```
   cd /usr/local/openvpn_as/scripts
   ./sacli --key "auth.module.post_auth_script" --value_file=/root/ip.py ConfigPut
   ./sacli start
   ```

   - When users sign in, they will be denied access until you register their IP address.
5. Manually register a user's IP address. For our command, "exampleuser" is the user account name, and `192.0.2.13` is the client's IP address:

   ```
   cd /usr/local/openvpn_as/scripts
   ./sacli -u "exampleuser" -k "pvt_clientip" -v "192.0.2.13" UserPropPut
   ./sacli start
   ```

   > **Tip**
   >
   > Depending on your authentication system, you may need to pay attention to lowercase/uppercase with the username.

## Troubleshoot with log files

The post-auth script outputs information to the log file, **/var/log/openvpnas.log** , on most Access Server setups. You can review the log to help you troubleshoot if you encounter issues.

Filter for specific log messages from post-auth:

```
egrep "POST_AUTH" /var/log/openvpnas.log
```

> **Note**
>
> You can also edit the **ip.py** file on your server and add `print` lines to it to dump more information into the log file.

---

Prev: [Tutorial: How to Set Up Hardware Address Checking with a Post-auth Script](https://openvpn.net/as-docs/tutorials/tutorial--hardware-address-post-auth.md)
Next: [Tutorial: Add Duo Two-Factor Authentication to Access Server](https://openvpn.net/as-docs/tutorials/tutorial--duo-post-auth.md)
Index: https://openvpn.net/as-docs/llms.txt