VPN client endpoint interfaces have public IP, how to remove?

Question

Hi,  
  
I have created a VPN client endpoint and everything is working.  It is associated with a with a subnet that is configured not to automatically allocate a public IP address.  When I look at the EC2 interface dashboard, I see two network interfaces associated with the VPN endpoint and they both have public ip addresses listed.  How do I remove the public ip addresses?  Those address are different from the public IP address that VPN clients connect to.  
  
THanks,  
Bill

Accepted Answer

Hello Bill,  
  
The Elastic Network Interfaces (ENIs) created for Client VPN Endpoint will get a public IP assigned as long as the VPC is attached to a IGW and it cannot be removed. The IPv4 auto-assign attribute of the respective subnets will not affect this public IP assignment, so it works slightly differently than the EC2 ENIs.  
  
You are correct that this public IP is not the one you will use to connect to the Client VPN. Instead, this IP is used as the source IP for traffic coming from Client VPN destined to Internet via IGW as described in https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-internet.html .  
  
It's similar to how a EC2 instance in public subnet uses its assigned public IP as source IP to access Internet. Traffic coming from a machine connected to Client VPN and destined to Internet will use this public IP as the source IP to access Internet, given that you configure appropriate authorization rules and routes to allow this to happen.  
  
Thanks.  
Shawn

Answer

The network interfaces associated with the Client VPN endpoint will always have public IP addresses assigned to them regardless of the subnet configuration. This is because the public IP is used as the source IP for traffic originating from the VPN clients destined for the internet.

However, these public IPs are not the one used by VPN clients to connect to the endpoint. The IP clients connect to is specified separately during endpoint creation.

https://repost.aws/questions/QUXQ8aH5RQTr-JRSXK2s9N7w/vpn-client-endpoint-interfaces-have-public-ip-how-to-remove

VPN client endpoint interfaces have public IP, how to remove?

関連するコンテンツ