Cannot Route to EC2 Instance Via ClientVPN

Question

Hello there,

I have created a client VPN with the intention of connecting from the CVPN to a VPC which will house an archive parser application hosted on an EC2 instance.

I can't seem to reach the instance from the VPN or vice versa, the VPN is setup and I can connect and obtain an IP Address and authentication seems fine (Federated SAML to AzureAD)

I've checked the following:

Security Groups (Set to allow incoming traffic from the specific subnet on the ports required), Network ACL's also configured
Route Table via the Client VPN Settings and there is a default route to the VPC Subnet
Target Network Association - is configured to the correct subnet 
Authorization Rules - Configured to the Subnet Required

The EC2 Instance has an elastic IP but we want to house an internal application and not have it publicly accessible

It's most likely some sort of routing issue but I'm struggling to identify where, when I run a traceroute from both machines there are maybe one or two hops then it fails.

Any help is appreciated.

Accepted Answer

Seems like this was the fix:
1. Creating a Security Group Explicitly for the Client-VPN 
2. Attach Security Group (CVPN SG) to the Client-VPN-Endpoint under Security Groups
3. Create some Outbound rules for the CVPN SG depending on your use case
4. Create Some Inbound rules on the Application/EC2 Security Group to allow inbound from that specific security group only.
5. Test accessible via VPN and not on public internet (works as expected but only to the internal IP which is fine for this use case!)

![Enter image description here](/media/postImages/original/IMyijSNzqwR2iZTLJWvrij7Q)

Thanks

Answer

You have not mentioned the security group on the VPN Client. Have you created the correct Inbound rules here for traffic from the Client VPN to the VPN/VPC?

Cannot Route to EC2 Instance Via ClientVPN

Relevant content