Is there any way to forcefully limit OpenVPN client's addresses?
I.e. for each of multiple clients (identified by certificates) offer a specific IP address and disallow it to use any other.
It (something at least) has to be done on OpenVPN level itself, since there seems to be no differentiation between clients on the tap interface on server, but I can't find anything appropriate.
There is a good section on this in the OpenVPN documentation: Configuring client-specific rules and access policies.