How to Create Client VPN Endpoints on Amazon Web Service(AWS).

The Client VPN endpoint is the resource that you create and configure to enable and manage client VPN sessions. It is the resource where all client VPN sessions are terminated. Target network. A target network is the network that you associate with a Client VPN endpoint. A subnet from a VPC is a target network.

The client establishes the VPN session from their local computer or mobile device using an OpenVPN-based VPN client application. After they have established the VPN session, they can securely access the resources in the VPC in which the associated subnet is located.

 

  • Login to aws portal.
  • Click on Services.

 

Fig 1

 

  • Under Networking & Content Delivery select VPC.

 

Fig 2

 

  • Click on Client VPN Endpoints.

 

Fig. 3

 

  • Click on Create Client VPN Endpoint.

 

Fig. 4

 

  • Provide Client VPN Endpoint tag name.
  • Provide Client IPv4 CIDR.Specify an IP address range, in CIDR notation, from which to assign client IP addresses.
  • Provide Server certificate ARN.The server certificate must be provisioned in AWS Certificate Manager (ACM).
  • Select one or more authentication methods.These methods are how end users are authenticated.Choose Use user-based authentication.

 

Fig. 5

 

  • Select Active Directory authentication.
  • Provide Directory ID.

 

Fig. 6

 

  • If you want to log the details on client connection then select yes otherwise no.
  • Select yes,provide Cloudwatch Logs log group name & log stream name.
  • You can enable Client Connect Handler to run custom logic that allows or denies a new VPN connection to your Client VPN endpoint.
  • Provide DNS Server 1 & 2 IP address.To use VPC DNS server, for either DNS Server 1 IP address or DNS Server 2 IP address, specify the IP addresses, and add the VPC DNS server IP address.
  • Select protocol.To use TCP protocol for Transport Protocol.

 

Fig. 7

 

  • Select existing VPC.
  • Select existing Security Groups.

 

Fig. 8

 

  • Select 443 VPN port number.
  • Enable self-service portal for your endpoint to allow end-users to download the endpoint’s client configuration and client application.
  • Click on Create Client VPN Endpoint.

 

Fig 9

 

  • After sometime Client VPN Endpoint is ready.
  • Click on Associations.

Fig 10

 

  • Select existing VPC & Subnet.
  • Click on Associate.

 

Fig 11

 

  • After sometime Associate a subnet to client vpn point is done.

 

Fig 12

 

Create Client VPN Endpoint using Shell

create-client-vpn-endpoint –client-cidr-block ip-address –server-certificate-arn <value> –authentication-options <value> –connection-log-options ture/false —CloudwatchLogGroup –group-name –CloudwatchLogStream stream-name [–dns-servers dns-ip-address] [–transport-protocol tcp/udp] [–vpn-port 443/1194] [–security-group-ids security-group-id] [–vpc-id vpc-id] [–self-service-portal enabled/disabled]

 

Leave a Reply