I'm using AWS vpn endpoint to connect vpn clients to a subnet: vpn info vpn routing I am able to ping an ec2 instance on cidr when connected using the vpn endpoint. However that ec2 instance is unable to ping clients using their client ip in the cidr.

Do I have to update the routing rules on the VPC or Subnet to access the client cidr? The VPC is currently on cidr and the subnet the ec2 instance is on is on subnet with cidr


I had opened a ticket in AWS Support and they confirmed that is working as designed: traffic will ONLY work in one direction. It is because client's IP is NAT'd. Here is AWS Support response for my ticket response:

I understand that you have a client VPN (CVPN) set up and you were able to successfully connect (initiate TCP connection) to EC2 instances, but the EC2 instances cannot connect to the client IP assigned to the clients.

As stated in the following link: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-client-vpn-to-securely-access-aws-and-on-premises-resources/

Note that CVPN will use source NAT (SNAT) to connect to resources in the associated VPC(s).

So, any traffic initiated from the client's IP will be NAT'd (source IP of the client will be changed) to the IP address of the CVPN endpoint. So, the EC2 instance will see as if the traffic is being sourced from the CVPN endpoint IP and not from the client's IP. Also, the VPC route table will not have a route to the client IP's subnet (refer to VPC route table rtb-0ef010cd7b387b8ff). Hence, the connection can only be initiated from the client to the EC2 instance and it wouldn't work for the connections initiated in the other direction.

  • Hey Rodrigo - does this mean that VPN traffic is from VPN clients into VPC and not the other way around? is two way traffic not possible? – Marko Jun 6 '19 at 12:04
  • @Rodrigo Pompei Did you find any alternative? – Rohit Hazra Aug 9 '19 at 6:05

check the Security Groups; once you associate the first subnet with the endpoint, AWS automatically adds a default security group, which may not allow incoming ICMP traffic from the subnet where the EC2 is running.

  • The security group allows all traffic – Zachscs Apr 26 '19 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.