Rules and best practices for using AWS Client VPN

A minimum bandwidth of 10 Mbps is supported per user connection. The maximum bandwidth per user connection depends on the number of connections being made to the Client VPN endpoint.

Client CIDR ranges cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or any routes manually added to the Client VPN endpoint's route table.

Client CIDR ranges must have a block size of at least /22 and must not be greater than /12.

A portion of the addresses in the client CIDR range are used to support the availability model of the Client VPN endpoint, and cannot be assigned to clients. Therefore, we recommend that you assign a CIDR block that contains twice the number of IP addresses that are required to enable the maximum number of concurrent connections that you plan to support on the Client VPN endpoint.

The client CIDR range cannot be changed after you create the Client VPN endpoint.

The subnets associated with a Client VPN endpoint must be in the same VPC.

You cannot associate multiple subnets from the same Availability Zone with a Client VPN endpoint.

A Client VPN endpoint does not support subnet associations in a dedicated tenancy VPC.

Client VPN supports IPv4 traffic only. See IPv6 considerations for AWS Client VPN for details regarding IPv6.

Client VPN is not Federal Information Processing Standards (FIPS) compliant.

The self-service portal is not available for clients that authenticate using mutual authentication.

We do not recommend connecting to a Client VPN endpoint using IP addresses. Because Client VPN is a managed service, you will occasionally see changes in the IP addresses to which the DNS name resolves. In addition, you will see Client VPN network interfaces deleted and recreated in your CloudTrail logs. We recommend connecting to the Client VPN endpoint using the DNS name provided.

IP forwarding is not currently supported when using the AWS Client VPN desktop application. IP forwarding is supported from other clients.

Client VPN does not support multi-Region replication in AWS Managed Microsoft AD. The Client VPN endpoint must be in the same Region as the AWS Managed Microsoft AD resource.

If multi-factor authentication (MFA) is disabled for your Active Directory, user passwords cannot use the following format.

SCRV1:base64_encoded_string:base64_encoded_string

You can't establish a VPN connection from a computer if there are multiple users logged into the operating system.

The Client VPN service requires that the IP address the client is connected to matches the IP that the Client VPN endpoint's DNS name resolves to. In other words, if you set a custom DNS record for the Client VPN endpoint, then forward the traffic to the actual IP address the endpoint's DNS name resolves to, this setup will not work using recent AWS provided clients. This rule was added to mitigate a server IP attack as described here: TunnelCrack.

The Client VPN service requires that the local area network (LAN) IP address ranges of client devices be within the following standard private IP address ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 169.254.0.0/16. If the client LAN address range is detected to fall outside of the above ranges, the Client VPN endpoint will automatically push the OpenVPN directive "redirect-gateway block-local" to the client, forcing all LAN traffic into the VPN. Therefore, if you require LAN access during VPN connections, it is advised that you use the conventional address ranges listed above for your LAN. This rule is enforced to mitigate chances of a local net attack as described here: TunnelCrack.

Certificates used in AWS Client VPN must adhere to RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, including the Certificate Extensions specified in section 4.2 of the memo.