---
title: 'Tutorial: Set a Static IP Address for a User Through a Group Subnet'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--static-group-ip-address/
product: Access Server Docs
description: Set up a unique subnet using a group IP address network and Access Server will then have a subnet it can use for static IP address assignment.
---

# Tutorial: Set a Static IP Address for a User Through a Group Subnet

## Overview

This tutorial shows how to set up static IP address assignments for Access Server users through a group assignment. Alternatively, you can use a [global static IP address network to assign a static IP address to a user](https://openvpn.net/as-docs/tutorials/tutorial--static-vpn-client-ip-address.md).

Refer to this [tutorial](https://openvpn.net/as-docs/tutorials/tutorial--dynamic-group-ip-address.md) to set up a group dynamic IP address assignment.

### Default client address assignment

Access Server works with Layer 3 routing mode by default. In this mode, VPN clients are assigned addresses from a private subnet, which is different from other subnets used in your networks.

Access Server automatically assigns dynamic IP addresses to clients when they connect. This is usually done in sequential order until it reaches the end of the subnet portion available to the OpenVPN daemon the client connects with, at which point it starts reusing older addresses.

This behavior is similar to DHCP, but Access Server doesn't technically run a DHCP server. It's more like a rough emulation of assigning addresses automatically.

To find the subnet for VPN clients:

1. Sign in to the Admin Web UI.
2. Click **Configuration \> VPN Settings**.
   - The IP address and netmask bits are displayed under **Dynamic IP Address Network**.

> **Tip**
>
> If you're configuring static IP address assignments for Access Server in layer 2 mode, you must set the IP address on the client system's virtual network adapter. (We no longer recommend or offer support for using Access Server in layer 2 mode.)

> **Note**
>
> In our documentation, we use example IPv4 addresses and subnets [reserved for documentation](https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4), such as `192.0.2.0/24`, `198.51.100.0/24`, and `203.0.113.0/24`.
>
> Ensure you replace them with valid IPv4 addresses and subnets for your network(s).

## Prerequisites

- An [installed Access Server](https://openvpn.net/as-docs/installation.md).
- [User accounts](https://openvpn.net/as-docs/users.md).
- At least one [group account](https://openvpn.net/as-docs/groups.md).

> **Important**
>
> This tutorial doesn't apply to Access Server deployments configured in a cluster. Static IP address assignment isn't available in cluster mode.

## Step 1: Assign a group subnet

1. Sign in to the Admin Web UI.
2. Click **User Management \> Group Permission**.
3. Click **More Settings** for the group to assign the subnet.
   - Additional group settings display.
4. Enter the subnet for the static IP address network in **Subnets assigned to this group (optional)** under **VPN IP Addresses**.
5. Select **Save Settings** and **Update Running Server**.

> **Important**
>
> Each subnet's first and last IP address in Access Server is reserved. Suppose you specify the subnet **198.51.100.0/24**. You should ensure you don't assign **198.51.100.1** or **198.51.100.254** to VPN clients.
>
> We don't support public IP address subnets here. Access Server operates in a private network because it's a virtual private network solution. It's possible to force public IP addresses into Access Server's configuration, but we don't support that solution.

> **Tip**
>
> If helpful, you can refer to our [subnet mask cheat sheet](https://openvpn.net/as-docs/subnet-mask-cheat-sheet.md).

## Step 2: Assign a static IP address to the user

1. Click **User Management \> User Permissions**.
2. Click **More Settings** for the user to assign the static IP address.
   - Additional user settings display.
3. Under **IP Addressing** click **Use Static**.
4. Enter the static IP address into the **VPN Static IP Address** field.

   > **Important**
   >
   > Ensure the IP address falls within the static IP address network you previously defined.
5. Select **Save Settings** and **Update Running Server**.
   - Access Server now assigns the static IP address to your user when they connect.

## Step 3: Assign the user to the group

Finally, ensure the user is in the group you assigned the subnet:

1. Click the **Group** drop-down for the user.
2. Select the group from step 1.
3. Select **Save Settings** and **Update Running Server**.

---

Prev: [Tutorial: Assign a Static VPN Client IP Address to Users](https://openvpn.net/as-docs/tutorials/tutorial--static-vpn-client-ip-address.md)
Next: [Tutorial: Set Up Group Dynamic IP Address Assignments](https://openvpn.net/as-docs/tutorials/tutorial--dynamic-group-ip-address.md)
Index: https://openvpn.net/as-docs/llms.txt