почему не сформировать заранее и не отсылать через
push "route 10.0.0.0 255.255.255.0"

Через генерацию кастомного CCD для подключающегося клиента

; openvpn.conf

client-connect ./learn-tap0
client-disconnect ./learn-tap0

; learn-tap0

#!/bin/sh

IP="$ifconfig_pool_remote_ip"
TYPE="$script_type"

CCD="$1"
CNAME="$common_name"

if [ "$TYPE" = "client-connect" ]; then
    #/usr/sbin/arp -Ds $IP eth1 pub
    #echo "Add ARP for IP $IP"

    if [ "$CNAME" = "user1" ]; then
        echo "Generating custom CCD for user1 at $CCD"
        cp /etc/openvpn/ccd-tomsknets $CCD
    fi
    if [ "$CNAME" = "user2" ]; then
<------>echo "Generating custom CCD for user2 at $CCD"
<------>cp /etc/openvpn/ccd-tomsknets $CCD
    fi

    exit 0
fi

#if [ "$TYPE" = "client-disconnect" ]; then
    #/usr/sbin/arp -i eth1 -d $IP pub
    #echo "Delete ARP for IP $IP"
    #exit 0
#fi

exit 0