I have two certificates. One is "specific_cert" and the other is "generic_cert". I want specific cert to have ip 10.8.0.6 and generic_cert may be any other. However, when both machines connect to the VPN, both get assigned the same 10.8.0.6 IP.
Your issue is that you didn't exclude the range of static IPs you are handing out from your pool range. The
server directive is a helper-directive (see --server in the manpage) that automatically uses the entire remainder of the subnet for dynamic IP assignment. This creates a race-condition when the dynamic IP is assigned to the first client, then the 2nd one connects and is given a static IP that is identical to the one handed out earlier.
When using any form of static addressing, it is required to expand this helper-directive yourself and use a range that excludes any static IPs you wish to hand out; it may be wise to leave some growing room if you see the possibility to assign more IPs statically down the road
[edited to add]
A quick follow-up point: if you are using the default
net30 topology, the IP peering you have pushed is invalid for Windows clients, as they require peering in the center two IPs in a /30 subnet. (which would be .6 and .5 for the 2nd usable subnet in the /24.) Non-Windows clients will happily work with any 2 IPs as they set configure their interfaces PtP anyway, but Windows will exit with an error if the /30 addressing is incorrect.
Your other option is to use the
subnet topology where you configure each peer with an IP and a netmask, similar to a traditional subnet layout. This is supported on every platform since version 2.1, and is the recommended topology today. See --topology in the manpage for more details.
