AWS Client VPN

Site to Site VPN

Site to Site VPN

VGW IPSec CGW

VPN
On-premise
Client to Site VPN

Company Network
Client to site VPN

AWS Client VPN

Peered VPC

Endpoint Services

Client VPN
Endpoint
internet

Client

On-premise
AWS Client VPN Components

● VPC
● Target Network Subent
● Client VPN Endpoint
● Route
● Authorization Rules
● Client CIDR range
● Client VPN Network Interfaces
● Authentication (Mutual, AD based, SAML based federated)
● Authorization (Security groups, Authorization groups)
● Client
AWS Client VPN components
ACM AD SAML/SSO

Authentication
192.168.0.0/16
VPC

Route

Security group
Client
Application Machine
associate
Subnets
ENI
AWS Client VPN
Authorization endpoint
VPN Target Rules Client CIDR
Subnet
(10.10.0.0/16)
AWS Client VPN Limitations
● Client CIDR ranges cannot overlap with the local CIDR of the VPC in which the
associated subnet is located
● Client CIDR ranges cannot overlap with any routes manually added to the Client VPN
endpoint's route table
● Client CIDR ranges must have a block size between /22 and /12
● The client CIDR range cannot be changed after you create the Client VPN endpoint
● You cannot associate multiple subnets from the same Availability Zone with a Client VPN
endpoint
● A Client VPN endpoint does not support subnet associations in a dedicated tenancy VPC
● Client VPN supports IPv4 traffic only
AWS Client VPN Pricing (N. Virginia region)
● AWS Client VPN endpoint association -> $0.10 per hour
● AWS Client VPN connection -> $0.05 per hour

Client

Client VPN $0.05/hr

Endpoint

Client

Client