diff --git a/stable/openvpn/Chart.yaml b/stable/openvpn/Chart.yaml
index dc91f99e34..575839acd8 100755
--- a/stable/openvpn/Chart.yaml
+++ b/stable/openvpn/Chart.yaml
@@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust
   generation is also part of the deployment, and this chart will generate client keys
   as needed.
 name: openvpn
-version: 4.1.0
+version: 4.2.0
 appVersion: 1.1.0
 maintainers:
 - name: jasongwartz
diff --git a/stable/openvpn/README.md b/stable/openvpn/README.md
index c775390076..9f393f103d 100644
--- a/stable/openvpn/README.md
+++ b/stable/openvpn/README.md
@@ -114,6 +114,8 @@ Parameter | Description | Default
 `openvpn.istio.enabled`              | Enables istio support for openvpn clients                            | `false`
 `openvpn.istio.proxy.port`           | Istio proxy port                                                     | `15001`
 `openvpn.iptablesExtra`              | Custom iptables rules for clients                                    | `[]`
+`openvpn.ccd.enabled`                | Enable creation and mounting of CCD config                           | `false`
+`openvpn.ccd.config`                 | CCD configuration (see below)                                        | `{}`
 `nodeSelector`                       | Node labels for pod assignment                                       | `{}`
 `tolerations`                        | Tolerations for node taints                                          | `[]`
 `ipForwardInitContainer`             | Add privileged init container to enable IPv4 forwarding              | `false`
@@ -156,6 +158,24 @@ And optionally (see openvpn.taKey setting):
 
 Note: using mounted secret makes creation of new client certificates impossible inside openvpn pod, since easyrsa needs to write in certs directory, which is read-only.
 
+### Client specific rules and access policies
+
+You can enable CCD using `openvpn.ccd.enabled` and set the config in `openvpn.ccd.config` to use [OpenVPN client specific rules and access policies](https://openvpn.net/community-resources/configuring-client-specific-rules-and-access-policies/)
+
+For example, if you want to give fixed IP addresses to clients 'johndoe' and 'janedoe':
+
+```
+openvpn:
+  ccd:
+    enabled: true
+    config:
+      johndoe: "ifconfig-push 10.240.100.10 10.240.100.11"
+      janedoe: "ifconfig-push 10.240.100.20 10.240.100.21"
+```
+
+For more options see the OpenVPN documentation. Note that the IPs provided here depend on the type of topology you use.
+
+
 ## Issues
 
 ### 1. Routing / ip_forward
diff --git a/stable/openvpn/templates/config-ccd.yaml b/stable/openvpn/templates/config-ccd.yaml
new file mode 100644
index 0000000000..ea31b9a0a0
--- /dev/null
+++ b/stable/openvpn/templates/config-ccd.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.openvpn.ccd.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "openvpn.fullname" . }}-ccd
+  labels:
+    app: {{ template "openvpn.name" . }}
+    chart: {{ template "openvpn.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+{{ toYaml .Values.openvpn.ccd.config | indent 2 }}
+{{- end }}
diff --git a/stable/openvpn/templates/config-openvpn.yaml b/stable/openvpn/templates/config-openvpn.yaml
index e457def2d0..5d746711ad 100644
--- a/stable/openvpn/templates/config-openvpn.yaml
+++ b/stable/openvpn/templates/config-openvpn.yaml
@@ -202,6 +202,10 @@ data:
       user nobody
       group nogroup
 
+{{ if .Values.openvpn.ccd.enabled }}
+      client-config-dir /etc/openvpn/ccd
+{{ end }}
+
 {{ if .Values.openvpn.DEFAULT_ROUTE_ENABLED }}
       push "route NETWORK NETMASK"
 {{ end }}
diff --git a/stable/openvpn/templates/openvpn-deployment.yaml b/stable/openvpn/templates/openvpn-deployment.yaml
index a784554234..b56d9c4103 100644
--- a/stable/openvpn/templates/openvpn-deployment.yaml
+++ b/stable/openvpn/templates/openvpn-deployment.yaml
@@ -90,11 +90,21 @@ spec:
             {{- end }}
             name: certs
             readOnly: {{ if .Values.openvpn.keystoreSecret }}true{{ else }}false{{ end }}
+            {{- if .Values.openvpn.ccd.enabled }}
+          - mountPath: /etc/openvpn/ccd
+            name: openvpn-ccd
+            {{- end }}
       volumes:
       - name: openvpn
         configMap:
           name: {{ template "openvpn.fullname" . }}
           defaultMode: 0775
+      {{- if .Values.openvpn.ccd.enabled }}
+      - name: openvpn-ccd
+        configMap:
+          name: {{ template "openvpn.fullname" . }}-ccd
+          defaultMode: 0775
+      {{- end }}
       - name: certs
         {{- if .Values.persistence.enabled }}
         persistentVolumeClaim:
diff --git a/stable/openvpn/values.yaml b/stable/openvpn/values.yaml
index 4ad03d0d25..96f895af69 100644
--- a/stable/openvpn/values.yaml
+++ b/stable/openvpn/values.yaml
@@ -126,6 +126,12 @@ openvpn:
   # - -A FORWARD -m conntrack --ctstate NEW -d 10.240.0.0/255.255.0.0 -j ACCEPT
   # - -A FORWARD -j REJECT
 
+  # Enable CCD support
+  ccd:
+    enabled: false
+    config: {}
+    # johndoe: "ifconfig-push 10.240.100.10 10.240.100.11"
+    # janedoe: "ifconfig-push 10.240.100.20 10.240.100.21"
 
 nodeSelector: {}
 tolerations: []