AWS Client VPN timeout

Based on the information you've provided, it sounds like you're experiencing connection issues with your AWS Client VPN endpoint that was previously working fine. The timeout issues affecting all team members suggest a system-wide problem rather than an individual client issue.

The discrepancy you noticed between the IP addresses returned by DNS and the public IPs associated with the ENIs is actually normal behavior. AWS Client VPN uses a DNS name that resolves to AWS-managed infrastructure, which then routes traffic to your endpoint's ENIs.

Here are some troubleshooting steps to consider:

1. Check if there have been any recent changes to your AWS Client VPN configuration, such as modifications to the maximum VPN session duration or timeout behavior.

2. Verify that your client configuration files (.ovpn) are still valid and haven't been corrupted.

3. Look for error messages in your client logs. On macOS, you might see specific error messages like DNS resolve errors or connection timeouts that can help diagnose the issue.

4. Check if there have been any AWS service disruptions in your region that might be affecting the Client VPN service.

5. Ensure that your client devices can properly resolve the DNS hostname for your VPN endpoint.

6. If you're using SAML or Active Directory authentication, verify that your identity provider is still functioning correctly.

7. Consider temporarily modifying your Client VPN endpoint settings to see if that resolves the issue.

If the problem persists after these steps, you may need to contact AWS Support for further assistance, as there could be an underlying issue with the AWS Client VPN service itself.
Sources
Troubleshooting AWS Client VPN connections with macOS clients - AWS Client VPN
AWS VPN Client stuck on reestablishing connection indefinitely | AWS re:Post

✅ Problem:

Worked for years, suddenly all clients fail to connect.

Security groups & certs look fine.

ENIs have different public IPs than what DNS resolves.

💡 Checklist / Fix:

DNS mismatch is likely the culprit. AWS recently rotated Client VPN public IPs for some regions (documented in AWS announcements ).

Make sure your DNS is resolving to current endpoints:

Run dig +short <vpn-endpoint>.cvpn-endpoint.amazonaws.com

Verify those IPs match the ENI public IPs.

If not → try:

Restart the endpoint (disassociate & re-associate subnets, forces refresh of ENIs)

Or open a support ticket — sometimes AWS silently moves CVPN endpoints to new IPs.

Also verify NACLs (if using) are open to all 443 inbound.