OpenVPN Support Forum

I want to push a /32 route to the client so they can only access that single IP, but of course nothing prevents them from filtering that route and installing a /24 route to reach the whole subnet.
To protect against this, does openvpn have some config option or should it be done with iptables outside of openvpn?

The FOSS Openvpn-ce cannot control a wayward client.

The protection you require must be configured on the server side.