Client VPN Endpoint local traffic routing disfunctional

Based on your description, it sounds like you're experiencing an issue with client-to-client communication in AWS Client VPN. This is likely related to how AWS Client VPN handles routing between clients.

For AWS Client VPN, there are a few key points to understand:

1. By default, the Client VPN endpoint NATs all traffic from clients to the elastic network interface (ENI) in the subnet. This NAT behavior provides one-way access where clients can reach the private network, but bidirectional connectivity between clients is not automatically supported.

2. While you've correctly set up a route with destination CIDR 172.16.48.0/20 with a target of local, there might be an issue with how the traffic is being routed between different subnets within your Client VPN CIDR range.

3. The issue you're seeing where clients in 172.16.48.* cannot communicate with clients in 172.16.49.* suggests that there might be limitations in how the local target handles routing across different subnets within the Client VPN CIDR block.

To address this issue, you could try:

1. Enable client-to-client access in your Client VPN endpoint configuration if it's available. This option specifically allows communication between clients connected to the same VPN endpoint.

2. Consider using a smaller subnet mask for your Client VPN CIDR to ensure all clients fall within the same subnet (e.g., use a /24 instead of /20).

3. Check if there are any security groups or network ACLs that might be blocking traffic between these IP ranges.

4. Verify that your authorization rules properly allow traffic between the Client VPN CIDR ranges.

If these solutions don't resolve the issue, it might indeed be a limitation of how AWS Client VPN handles routing between different subnets within the assigned CIDR range.
Sources
Bidirectional Client VPN Endpoint connectivity | AWS re:Post