Is there another directive in global to track which client is connecting and execute commands based on con/disconnect status?
Yes. See the
--client-connect and
--client-disconnect config options that allow you to run a script or program when clients connect or disconnect. In the connect script, you can even perform additional authentication tasks or push directives to clients just like with a ccd file.
It sounds like you want a connect script that checks the common_name variable for relevant clients with networks behind them and adds an iroute and system routes when the client connects. You can then remove the relevant routes in a disconnect script.
I have an open-source github project called
openvpn-dynamic that contains some components for on-connect and on-disconnect accounting that you may like to check out. While this doesn't exactly do what you want, it will give you an idea of how this functionality works.
