Feature Request: Multiple named `--ifconfig-pool` pools with dynamic group-based selection

[Smiley-k]

Problem Statement

Modern OpenVPN deployments increasingly use external authentication — OAuth2/OIDC (openvpn-auth-oauth2), LDAP, RADIUS. Users authenticate and authorize via groups/roles, and each group needs its own IP subnet for:

• Firewall rules (MikroTik, iptables) based on source subnet
• Monitoring and session tracing
• Quality of Service policies
• Access segregation to internal resources

Example use-case:

Group	Required subnet
support	10.8.3.0/24
all (regular VPN)	10.8.0.0/24
Administrators	10.8.0.0/24 with per-user static IP

Currently OpenVPN supports only a single pool via --server or --ifconfig-pool. There is no mechanism to define multiple pools and dynamically select which pool to assign an IP from based on the client's group/role.

Current Workarounds and Their Limitations

1. CCD + static IPs (ifconfig-push)

Each profile/group gets a CCD file with ifconfig-push. However:

• This is a static assignment, not a pool — all users in the same group would get the same IP, which doesn't work for concurrent connections.
• Per-user CCD files don't scale (N users = N files to manage).
• No dynamic IP allocation — you must manually manage the address space.

2. client-connect script with external IPAM

A custom script can maintain its own pool DB and issue ifconfig-push via the management interface. Drawbacks:

• OpenVPN is unaware of this external pool — no conflict detection with --ifconfig-pool.
• No integration with OpenVPN's built-in pool tracking.
• Requires external locking and persistence mechanisms.
• Duplicates functionality that should be in the core.

3. client-auth (MDA) + ifconfig-push

When using the management interface (e.g. openvpn-auth-oauth2), the client-auth command can include a config block with ifconfig-push. This works, but:

• There's no way to say "give me any free IP from pool X" — you must hardcode the IP.
• The selected profile/group info is available at auth time but cannot be used to select a pool dynamically.

4. Profile selector + per-profile static IPs (our current setup)

Our current setup:

• /etc/openvpn-auth-oauth2/client-config/Access_VPN_all.conf — no ifconfig-push, IP from the default pool
• /etc/openvpn-auth-oauth2/client-config/Access_VPN_support.conf — ifconfig-push 10.8.3.10
• Per-user CCD for admins — ifconfig-push 10.8.3.12

The CEL expression in openvpn-auth-oauth2 v2 correctly selects the config file based on Keycloak groups, but all users from the support group still get the same static IP. This is fine for our current scale, but it doesn't scale to multiple concurrent users per group without IP conflicts.

Proposed Feature: Named --ifconfig-pool pools with dynamic selection

Server configuration

Allow defining multiple named pools in server.conf:

ifconfig-pool support 10.8.3.0 255.255.255.0 10.8.3.10-10.8.3.250
ifconfig-pool all     10.8.0.0 255.255.255.0 10.8.0.10-10.8.0.250

Where the syntax could be:

ifconfig-pool <name> <network> <netmask> [<start-ip>-<end-ip> | <size>]

If no explicit start/end range is given, the pool auto-calculates from the network.

Per-client pool selection

Add a new option for CCD files and client-auth config blocks:

# In CCD file:
ifconfig-pool "support"

# Or in client-auth config block sent via management interface:
ifconfig-pool "all"

When ifconfig-pool "name" is present instead of ifconfig-push, OpenVPN would:

1. Look up the named pool
2. Allocate the next free IP from that pool
3. Track the allocation (including in the status file)
4. Release on disconnect (same as the existing pool mechanism)

Priority/fallback behavior

• If a client has both ifconfig-pool "name" in CCD and the server has a matching pool — use it.
• If the named pool doesn't exist or is exhausted — fall back to the default --ifconfig-pool.
• If ifconfig-push is also present — ifconfig-push takes precedence (backward compatibility).

Integration with client-auth (management interface)

This is especially important for OAuth2 flows. When openvpn-auth-oauth2 calls:

client-auth CID KID\n
ifconfig-pool "support"\n
END\n

OpenVPN would allocate from the support pool instead of the default one.

Benefits

• No code changes needed in auth plugins — the plugin already sends config blocks; it just needs the ability to specify a pool name instead of a hardcoded IP.
• Backward compatible — existing --ifconfig-pool without a name becomes the default pool.
• Scales — multiple users in the same group each get a unique IP from their group's subnet.
• Integrates with status file, conflict detection, and pool tracking.
• CCD-friendly — group-level CCD files can use ifconfig-pool "name" instead of per-user ifconfig-push.

Use Cases Beyond OAuth2 Groups

• RADIUS pools — RADIUS server could return a pool attribute (e.g. Framed-Pool).
• Multi-tenant servers — different customers on the same OpenVPN instance get IPs from different subnets.
• Certificate-based — different certificate OUs could map to different pools via CCD.

Related

• openvpn-auth-oauth2 issue #896 — "Different IP pools per group" (feature request in the auth plugin, but the real limitation is in OpenVPN core)

[schwabe]

In my honest opinion this sounds like a very narrow use case. Most people that want have this level of fine control of assigned IP addresses will just use client-connect or management to assign those IP addresses. Or you will use one internal pool managed by OpenVPN itself and assign specialised IPs from a different pool with these possiblities.

This does not mean that we will not accept this feature if there are good patches for it but I don't think this is a likely candidate to be implemented by one of the current maintainers.

[cron2]

This is just a duplicate of a long-standing feature request to have multiple IP pools, and select one of them from ccd/ or plugin. I'm too lazy to search for it now, but it shouldn't be hard to find.

... I do have a use case where I fiddle the IP assignment for the two different rules via client-connect-script, and it's much more work than just telling openvpn "ey, this client gets pool B".

Of course someone needs to write the code, and my ugly script is already finished, so I focused elsewhere.

[cron2]

#960 (and #987) ... wasn't really that hard to find. Search issues for "ip-pool" and it's the first hit.

[Smiley-k]

@schwabe thanks for the feedback — but let me clarify

The core scenario is: one OpenVPN server, many access profiles, each needing its own IP subnet.

In our case:

• Auth is OAuth2/OIDC via openvpn-auth-oauth2
• Users are assigned a profile (e.g. "finance", "support", "outsource") based on their Keycloak group via CEL
• Each profile must get IPs from a distinct subnet/ranges within a shared /22
• MikroTik/iptables then applies firewall rules based solely on source subnet

Why multiple instances doesn't scale: separate ports, separate configs per client, separate monitoring, and every new department adds more operational surface. One instance managing many profiles is cleaner.

Why external client-connect + custom IPAM is suboptimal: OpenVPN's status file doesn't track externally-assigned IPs, conflict detection is lost, and on server restart the external DB and OpenVPN state can drift. The auth plugin (openvpn-auth-oauth2) can already send ifconfig-push via client-auth — but it can only hardcode an IP, not say "give me any free IP from pool X".

The feature request is really about extending the existing --ifconfig-pool syntax to support named pools, with a corresponding ifconfig-pool "name" directive in CCD/client-auth config blocks for dynamic allocation. Backward compatible: unnamed pool becomes the default.

That said — I understand maintainer is limited. The discussion alone is valuable for future reference.

@cron2 #960 and #987 are indeed the same feature. I should have searched more thoroughly before posting, my apologies for the duplicate.

Adding a use-case note from an OAuth2-deployment perspective:

When using openvpn-auth-oauth2 (or any auth plugin that uses the management interface's client-auth command), IP assignment happens at auth time via a config block in the client-auth reply. Currently this config block can include ifconfig-push — but only with a hardcoded IP. There's no way to say "allocate from pool X".

A ifconfig-pool "pool_name" directive in the client-auth config block would solve this:

• The auth plugin knows the user's group/role (from OAuth2 claims)
• It selects a pool name based on that group
• OpenVPN allocates the next free IP from the named pool
• Status file, conflict detection, and release on disconnect all work natively

This is the missing piece for single-instance multi-tenant OpenVPN with OAuth2.

I'll try what you're talking about, I'll use the script, I don't know how successful it will be, but if you use it, it means it's possible and it works.... I'll try my luck))

And thank you both very much for the feedback! If this ever lands as a feature, it would be incredibly useful for multi-profile and multi-tenant installations 🙏. Thank you for your time.