Tutorial: Assign a Static VPN Client IP Address to Users
Set up a unique subnet in the VPN Settings page in the Admin Web UI and the Access Server will then have a subnet it can use for static IP address assignment.
Overview
This tutorial shows how to set up static IP address assignments for Access Server users in the Admin Web UI. Here we set up a global static IP address network, but you can also use a group static IP address network to assign a static IP address to a user.
Default Client Address Assignment
Access Server works with Layer 3 routing mode by default. In this mode, VPN clients are assigned addresses from a private subnet, which is different from other subnets used in your networks.
Access Server automatically assigns dynamic IP addresses to clients when they connect. This is usually done in sequential order until it reaches the end of the subnet portion available to the OpenVPN daemon the client connects with, at which point it starts reusing older addresses.
This behavior is similar to DHCP, but Access Server doesn't technically run a DHCP server. It's more like a rough emulation of assigning addresses automatically.
To find the subnet for VPN clients:
Sign in to the Admin Web UI.
Click Configuration > VPN Settings.
The IP address and netmask bits are displayed under Dynamic IP Address Network.
Note
We use example IPv4 addresses and subnets reserved for documentation in our examples, such as 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24.
Replace them with valid IPv4 addresses and subnets for your network(s).
Set up a second private subnet, different from the default, dynamic IP address network:
Sign in to the Admin Web UI.
Click Configuration > VPN Settings.
Enter your static IP address with the netmask under Static IP Address Network (Optional).
Important
Each subnet's first and last IP address in Access Server is reserved. Suppose you specify the subnet 198.51.100.0/24. You should ensure you don't assign 198.51.100.1 or 198.51.100.254 to VPN clients.
We don't support public IP address subnets here. Access Server operates in a private network because it's a virtual private network solution. It's possible to force public IP addresses into Access Server's configuration, but we don't support that solution.
Tip
If helpful, you can refer to our subnet mask cheat sheet.
Click User Management > User Permissions.
Click More Settings for the user to assign the static IP address.
Additional user settings display.
Under IP Addressing click Use Static.
Enter the static IP address into the VPN Static IP Address field.
Important
Ensure the IP address falls within the static IP address network you previously defined.
Access Server now assigns the static IP address to your user when they connect.