diff --git a/src/etc/inc/openvpn.inc b/src/etc/inc/openvpn.inc
index 081f06fe09..084c4aa6d6 100644
--- a/src/etc/inc/openvpn.inc
+++ b/src/etc/inc/openvpn.inc
@@ -832,6 +832,17 @@ function openvpn_reconfigure($mode, $settings) {
 				break;
 		}
 	}
+	if ($settings['dev_mode'] === 'tun' && isset($config['unbound']['enable']) && isset($config['unbound']['regovpnclients'])) {
+		switch($settings['mode']) {
+			case 'server_tls':
+			case 'server_tls_user':
+				$domain = !empty($settings['dns_domain']) ? $settings['dns_domain'] : $config['system']['domain'];
+				if (is_domain($domain)) {
+					$conf .= "learn-address \"/usr/local/sbin/openvpn.learn-address.sh $domain\"\n";
+				}
+				break;
+		}
+	}
 
 	/*
 	 * When binding specific address, wait cases where interface is in
diff --git a/src/etc/inc/unbound.inc b/src/etc/inc/unbound.inc
index ce490c5b5d..2effa40149 100644
--- a/src/etc/inc/unbound.inc
+++ b/src/etc/inc/unbound.inc
@@ -267,6 +267,15 @@ EOF;
 	$verbosity = isset($unboundcfg['log_verbosity']) ? $unboundcfg['log_verbosity'] : 1;
 	$use_caps = isset($unboundcfg['use_caps']) ? "yes" : "no";
 
+	if (isset($unboundcfg['regovpnclients'])) {
+		$openvpn_clients_conf .=<<<EOD
+# OpenVPN client entries
+include: {$g['unbound_chroot_path']}{$cfgsubdir}/openvpn.*.conf
+EOD;
+	} else {
+		$openvpn_clients_conf = '';
+	}
+
 	// Set up forwarding if it is configured
 	if (isset($unboundcfg['forwarding'])) {
 		$dnsservers = array();
@@ -378,6 +387,8 @@ include: {$g['unbound_chroot_path']}{$cfgsubdir}/host_entries.conf
 # dhcp lease entries
 include: {$g['unbound_chroot_path']}{$cfgsubdir}/dhcpleases_entries.conf
 
+{$openvpn_clients_conf}
+
 # Domain overrides
 include: {$g['unbound_chroot_path']}{$cfgsubdir}/domainoverrides.conf
 {$forward_conf}
diff --git a/src/usr/local/sbin/openvpn.learn-address.sh b/src/usr/local/sbin/openvpn.learn-address.sh
new file mode 100755
index 0000000000..2b98a22e94
--- /dev/null
+++ b/src/usr/local/sbin/openvpn.learn-address.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+# openvpn learn-address script maintaining DNS entries of connected clients in
+# unbound config.
+
+DOMAIN="${1}"
+OP="${2}"
+IP="${3}"
+CN="${4}"
+
+DIR="/var/unbound"
+PIDFILE="/var/run/unbound.pid"
+
+if [ -n "${IP}" -a "$(/usr/bin/basename ${IP})" = "${IP}" ]; then
+	CONF="${DIR}/openvpn.client.${IP}.conf"
+
+	case "${OP}" in
+
+		add|update)
+			TMPCONF=$(/usr/bin/mktemp "${CONF}.XXXXXX")
+			TMPSRV=$(/usr/bin/mktemp "${CONF}.XXXXXX")
+
+			if [ -f "${TMPCONF}" -a -f "${TMPSRV}" ]; then
+				# Remove all configs which mention the FQDN
+				/usr/bin/grep -l -null "^local-data: \"${CN}.${DOMAIN} A " ${DIR}/openvpn.client.*.conf | /usr/bin/xargs -0 /bin/rm
+				/bin/test -f "${CONF}" && /bin/rm "${CONF}"
+
+				# Add new local-data entry.
+				(
+					echo "local-data-ptr: \"${IP} ${CN}.${DOMAIN}\"" &&
+					echo "local-data: \"${CN}.${DOMAIN} A ${IP}\"" &&
+					echo "local-data: \"${CN} A ${IP}\""
+				) > "${TMPCONF}"
+
+				# Check syntax, install configuration and restart unbound.
+				(
+					echo "server:" &&
+					echo "chroot: ${DIR}" &&
+					echo "directory: ${DIR}" &&
+					echo "include: ${TMPCONF}"
+				) > "${TMPSRV}"
+
+				/bin/chmod 644 "${TMPCONF}" "${TMPSRV}"
+				/usr/local/sbin/unbound-checkconf "${TMPSRV}" && /bin/mv "${TMPCONF}" "${CONF}"
+
+				/bin/pkill -HUP -F "${PIDFILE}"
+			fi
+
+			/bin/test -f "${TMPCONF}" && /bin/rm "${TMPCONF}"
+			/bin/test -f "${TMPSRV}" && /bin/rm "${TMPSRV}"
+		;;
+
+		delete)
+			# CN is not set on delete.
+			/bin/test -f "${CONF}" && /bin/rm "${CONF}" && /bin/pkill -HUP -F "${PIDFILE}"
+		;;
+
+	esac
+fi
+
+exit 0
diff --git a/src/usr/local/www/services_unbound.php b/src/usr/local/www/services_unbound.php
index 942cfe786f..27d6e7601b 100644
--- a/src/usr/local/www/services_unbound.php
+++ b/src/usr/local/www/services_unbound.php
@@ -65,6 +65,9 @@ if (isset($a_unboundcfg['regdhcp'])) {
 if (isset($a_unboundcfg['regdhcpstatic'])) {
 	$pconfig['regdhcpstatic'] = true;
 }
+if (isset($a_unboundcfg['regovpnclients'])) {
+	$pconfig['regovpnclients'] = true;
+}
 
 $pconfig['port'] = $a_unboundcfg['port'];
 $pconfig['custom_options'] = base64_decode($a_unboundcfg['custom_options']);
@@ -183,6 +186,7 @@ if ($_POST['save']) {
 		$a_unboundcfg['forwarding'] = isset($pconfig['forwarding']);
 		$a_unboundcfg['regdhcp'] = isset($pconfig['regdhcp']);
 		$a_unboundcfg['regdhcpstatic'] = isset($pconfig['regdhcpstatic']);
+		$a_unboundcfg['regovpnclients'] = isset($pconfig['regovpnclients']);
 		$a_unboundcfg['active_interface'] = $pconfig['active_interface'];
 		$a_unboundcfg['outgoing_interface'] = $pconfig['outgoing_interface'];
 		$a_unboundcfg['system_domain_local_zone_type'] = $pconfig['system_domain_local_zone_type'];
@@ -350,6 +354,14 @@ $section->addInput(new Form_Checkbox(
 ))->setHelp('If this option is set, then DHCP static mappings will be registered in the DNS Resolver, so that their name can be resolved. '.
 					'The domain in %1$sSystem &gt; General Setup%2$s should also be set to the proper value.','<a href="system.php">','</a>');
 
+$section->addInput(new Form_Checkbox(
+	'regovpnclients',
+	'OpenVPN Clients',
+	'Register connected OpenVPN clients in the DNS Resolver',
+	$pconfig['regovpnclients']
+))->setHelp(sprintf('If this option is set, then the common name (CN) of connected OpenVPN clients will be registered in the DNS Resolver, so that their name can be resolved. This only works for OpenVPN servers (Remote Access SSL/TLS) operating in "tun" mode. '.
+					'The domain in %sSystem: General Setup%s should also be set to the proper value.','<a href="system.php">','</a>'));
+
 $btnadv = new Form_Button(
 	'btnadvcustom',
 	'Custom options',
@@ -412,6 +424,7 @@ events.push(function() {
 		hideCheckbox('forwarding', hide);
 		hideCheckbox('regdhcp', hide);
 		hideCheckbox('regdhcpstatic', hide);
+		hideCheckbox('regovpnclients', hide);
 		hideInput('btnadvcustom', hide);
 		hideInput('custom_options', hide || !showadvcustom);
 	}