Client VPN access to VPC

We have a single VPC that up until now we controlled access to an EC2 instance via firewall rules permitting a static IP from specific company offices. We now have a need to have a freelance developer get access to the EC2 instance, but we do not want to give access to our corporate remote access nor do they have a static IP.

I'm attempting to setup client VPN into the VPC. We have gotten as far as connecting, but can't seem to get access to the EC2 instance via SSH (or even ping it).

Example IPs:
EC2 VPC IP 10.0.0.2
EC2 default gateway 10.0.0.1
Client VPN IP 10.0.1.2

I'm able to ping 10.0.0.1 (the VPC default gateway) from both the EC2 instance and the client VPN, so this gives me the impression that the routing is setup correctly. I cannot ping the EC2 instance 10.0.0.2 from the client VPN. The default route on the EC2 instance is 10.0.0.1, so it shouldn't require any routing back to the client VPN network.

We setup ingress rules on the security group associated with the VPC to allow ICMP and SSH from 10.0.1.0/24, but no joy.

Any suggestions on where to look next?