---
title: 'Tutorial: Assign a Static VPN Client IP Address to Users'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--static-vpn-client-ip-address/
product: Access Server Docs
description: Set up a unique subnet in the VPN Settings page in the Admin Web UI, and the Access Server will then have a subnet it can use for static IP address assignment.
---

# Tutorial: Assign a Static VPN Client IP Address to Users

## Overview

This tutorial shows how to set up static IP address assignments for Access Server users in the Admin Web UI. Here, we set up a global static IP address network, but you can also [use a group static IP address network to assign a static IP address to a user](https://openvpn.net/as-docs/v3/tutorials/tutorial--static-group-ip-address.md).

> **Important**
>
> This tutorial doesn't apply to Access Server deployments configured in a cluster. Static IP address assignment at the user level is not available in cluster mode, and the related options are hidden in the Admin Web UI.

### Default client address assignment

Access Server works with Layer 3 routing mode by default. In this mode, VPN clients are assigned addresses from a private subnet, which is different from other subnets used in your networks.

Access Server automatically assigns dynamic IP addresses to clients when they connect. This is usually done in sequential order until it reaches the end of the subnet portion available to the OpenVPN daemon the client connects with, at which point it starts reusing older addresses.

This behavior is similar to DHCP, but Access Server doesn't technically run a DHCP server. It's more like a rough emulation of assigning addresses automatically.

To find the subnet for VPN clients:

1. Sign in to the Admin Web UI.
2. Click **VPN Server**.
3. Click the **Subnets** tab.
   - The IP address and netmask bits are displayed under **Dynamic subnet** for the **Default VPN client address pool**.

## Prerequisites

- An installed Access Server.
- User accounts.

## Step 1: Define private subnet

Set up a second private subnet, different from the default, dynamic IP address network:

1. Sign in to the Admin Web UI.
2. Click **VPN Server**.
3. Click the **Subnets** tab.
4. Enter your static IP address with the netmask under **Static IP address pool**.
5. Click **Save** and **Restart**.

> **Tip**
>
> If helpful, you can refer to our [subnet mask cheat sheet](https://openvpn.net/as-docs/v3/subnet-mask-cheat-sheet.md).

## Step 2: Assign a static IP address to the user

1. Click **Users**.
2. Click the username of the desired user account.
   - The single-user page displays.
3. Under **Networking**, set **IP addressing** to **Static**.
4. Enter the static IP address into the **IPv4** field.

   > **Important**
   >
   > Ensure the IP address falls within the static IP address network you previously defined.
5. Click **Save** and **Restart**.
   - Access Server now assigns the static IP address to your user when they connect.

---

Prev: [Client Address Management](https://openvpn.net/as-docs/v3/tutorials/client-address-management.md)
Next: [Tutorial: Set a Static IP Address for a User Through a Group Subnet](https://openvpn.net/as-docs/v3/tutorials/tutorial--static-group-ip-address.md)
Index: https://openvpn.net/as-docs/llms.txt