VPN client endpoint interfaces have public IP, how to remove?



I have created a VPN client endpoint and everything is working. It is associated with a with a subnet that is configured not to automatically allocate a public IP address. When I look at the EC2 interface dashboard, I see two network interfaces associated with the VPN endpoint and they both have public ip addresses listed. How do I remove the public ip addresses? Those address are different from the public IP address that VPN clients connect to.


asked 2 years ago290 views
1 Answer
Accepted Answer

Hello Bill,

The Elastic Network Interfaces (ENIs) created for Client VPN Endpoint will get a public IP assigned as long as the VPC is attached to a IGW and it cannot be removed. The IPv4 auto-assign attribute of the respective subnets will not affect this public IP assignment, so it works slightly differently than the EC2 ENIs.

You are correct that this public IP is not the one you will use to connect to the Client VPN. Instead, this IP is used as the source IP for traffic coming from Client VPN destined to Internet via IGW as described in https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-internet.html .

It's similar to how a EC2 instance in public subnet uses its assigned public IP as source IP to access Internet. Traffic coming from a machine connected to Client VPN and destined to Internet will use this public IP as the source IP to access Internet, given that you configure appropriate authorization rules and routes to allow this to happen.


answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions