# AWS Client VPN with Mutual Authentication: A Complete Guide to Securely Access Private Resources

### Introduction

Securely accessing cloud resources is a common challenge for many IT professionals. **AWS Client VPN** is a managed client-based VPN service that enables us to securely access our AWS resources and resources in our on-premises network. With Client VPN, we can access our resources from any location using an OpenVPN-based VPN client.

### Architecture

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/e3d45cfe-f4bf-4e0a-810d-ead569c8e463.jpg align="center")

*Architecture Diagram: Client VPN Connection*

### Procedure

**Prerequisites**

Before we begin, we need to have the following:

*   The permissions required to work with Client VPN endpoints.  
    Generate an appropriate IAM Role or if you have Administrator Access role that is sufficient.
    
*   The permissions required to import certificates into AWS Certificate Manager.  
    We will be using AWS CLI, Consequently Access key and Secret key are required.
    
*   A VPC with at least one subnet and an internet gateway. The route table that's associated with our subnet must have a route to the internet gateway.
    

**Step 1: Choose your endpoint type**

AWS Client VPN supports two endpoint types:

*   **VPC subnet association** for single-VPC access, and
    
*   **Transit Gateway association** for multi-VPC and hybrid network scenarios.  
    In this Blog we will configure using VPC-associated endpoints.
    

**Step 2: Generate server and client certificates and keys**

We will setup **EasyRSA** for generating the certificates and use mutual authentication, where Client VPN uses certificates to perform authentication between clients and the Client VPN endpoint.

**Install the EasyRSA,** from the link below.

[https://github.com/OpenVPN/easy-rsa/releases](https://github.com/OpenVPN/easy-rsa/releases)

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/c9eba42d-373e-4028-8be1-eb2e879264cb.png align="center")

Download the ZIP file appropriate for your operating system, extract it, navigate to the extracted directory, and open the <mark class="bg-yellow-200 dark:bg-yellow-500/30">easyrsa.bat</mark> file. These Easy-RSA commands initialize the **Public Key Infrastructure (PKI)**, create a **Certificate Authority (CA)**, and generate the **server and client certificates** required for mutual TLS authentication.

```plaintext
#easyrsa.bat

# Easy RSA Configuration
	 ./easyrsa init-pki
	 ./easyrsa build-ca nopass
	 ./easyrsa build-server-full server.domain.tld nopass
	 ./easyrsa build-client-full client1.domain.tld nopass
```

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/c9432bfd-98f3-4dbe-839d-7ee53d922221.png align="center")

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/8d759cfe-1a67-41ea-8eec-b237e5858e1c.png align="center")

Now, For ease, what we do is create an new folder and copy the certificates and key into that folder and upload those certificates to the AWS ACM.

Open a PowerShell new terminal and go into that EasyRSA directory where we previously ran commands and copy the certificates and key into a <mark class="bg-yellow-200 dark:bg-yellow-500/30">VPNDemo</mark> Directory.

```plaintext
#POWERSHELL

cd C:\Users\Acer\Downloads\EasyRSA-3.2.6-win64\EasyRSA-3.2.6
mkdir ~/VPNDemo
cp .\pki\ca.crt ~/VPNDemo/
cp .\pki\issued\server.domain.tld.crt ~/VPNDemo/
cp .\pki\private\server.domain.tld.key ~/VPNDemo/
cp .\pki\issued\client1.domain.tld.crt ~/VPNDemo/
cp .\pki\private\client1.domain.tld.key ~/VPNDemo/
cd C:\Users\Acer\VPNDemo\
```

After Creating client, server keys and certificates along with ca.crt. We will copy it into the new directory VPNDemo and from here we shall import Client and Server Certificates to the AWS ACM.

*<mark class="bg-yellow-200 dark:bg-yellow-500/30">NOTE: Before importing, Please run aws configure and Enter your Access key and Secret key.</mark>*

```plaintext
# Import server certificate to aws acm

aws acm import-certificate --certificate fileb://server.domain.tld.crt \     
--private-key fileb://server.domain.tld.key \
--certificate-chain fileb://ca.crt \
--region us-east-2
```

```plaintext
# Import Client certificate to aws acm

aws acm import-certificate --certificate
fileb://client1.domain.tld.crt \
--private-key fileb://client1.domain.tld.key \
--certificate-chain fileb://ca.crt \
--region us-east-2
```

*   Go to the AWS Management Console, Search for ACM and you shall see the Certificates there.
    

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/28e3f6b5-4413-49f4-918c-c54c1a7dbfbe.png align="center")

**Step 3: Create a Client VPN endpoint**

Before we create a Client VPN endpoint, We need to have a VPC with Private Subnet and we shall associate the endpoint to that private subnet.

Here, I have created a VPC named <mark class="bg-yellow-200 dark:bg-yellow-500/30">"demo-vpc"</mark>. For this blog I shall not cover creating VPC, You can easily create one.

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/8d320523-bf6c-43f1-9836-2d1497072f13.png align="center")

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/50e1dec3-4c9a-49a8-9bad-f9042fd6c89e.png align="center")

*   For creating Client VPN Endpoint, In the AWS Console, go to **VPC and click on Create Client VPN Endpoint**.
    

we can set the VPN endpoint Name and Description (both are optional). we will select the "demo-vpc" and the default security group.

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/3c5769b2-d485-4ef0-ae06-02ae8d64ab3a.png align="center")

we need to specify the Client VPN CIDR range between /12 and /22 and can't overlap with the target network, VPC address range or routes.

for now, we'll use **<mark class="bg-yellow-200 dark:bg-yellow-500/30">10.0.0.0/12</mark>**

**under Authentication:**

*   Select the **Server certificate ARN** from drop down that we have previously imported.
    
*   use mutual authentication for **Authentication options**.
    
*   Similarly, Select the **Client certificate ARN** from drop down that we have previously imported.
    

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/6f72991a-7622-407e-b868-9eb9fe353501.png align="center")

*   Enable **Self-service** Portal, under Client Interface
    
*   Select **split-tunnel**, From the Connection protocol
    

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/e3a6d278-3ada-4813-8f4b-d7e2a23e33c5.png align="center")

**Step 4: Associate a target network**

It’s important to note that once created, the endpoint will remain in the pending-associate state until a target network association is added. This means you’ll need to associate the endpoint with at least one subnet in your VPC before it becomes operational.

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/9b2306ff-8ab1-4531-ab90-f966ae60e7a4.png align="center")

**Step 5: Add an authorization rule for the VPC**

By default, nothing is accessible. we must explicitly allow access.

Authorization rules define what resources out VPN users can access. we can find this under the ‘Authorization Rules’ tab in our Client VPN endpoint settings.

Navigate to Authorization Rules. Add a rule that permits traffic to our VPC CIDR range (e.g., 192.168.0.0/16) and not our Client VPN CIDR range.

**Step 6: Configure Route Table**

The route table configuration determines where our VPN traffic should be directed.

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/79451fdf-a89d-4413-8087-62d9357723d2.png align="center")

**Step 7: Verify security group requirements**

Make sure your resources’ security groups allow inbound traffic from the Client VPN CIDR block.

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/ffa963c5-5496-40ec-9686-24f63442e3d3.png align="center")

For example:

*   Allow RDP (3389) for Windows instances.
    
*   Allow SSH (22) for Linux instances.
    
*   Allow ICMP if you want to test with ping.
    

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/ffa963c5-5496-40ec-9686-24f63442e3d3.png align="center")

**Step 8: Download the Client VPN endpoint configuration file and Configure it.**

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/cb9b6df4-5c78-4989-b142-d5e05e00d314.png align="center")

When all settings are configured and Client VPN state is available, download the client configuration file from the top of the dashboard by clicking on **Download client configuration.**

Before we use this configuration file, we need to modify it and add the certificate and key of the client.

Open the <mark class="bg-yellow-200 dark:bg-yellow-500/30">.ovpn</mark> file in a text editor and add the following blocks at the end, replacing the placeholders with the actual certificate and key content form your client cert and key file.

```plaintext
    <cert>
    -----BEGIN CERTIFICATE-----
    [Your client certificate content]
    -----END CERTIFICATE-----
    </cert>

    <key>
    -----BEGIN PRIVATE KEY-----
    [Your client private key content]
    -----END PRIVATE KEY-----
    </key>
```

**Step 9: Connect to the Client VPN endpoint**

To connect using the AWS provided client for Windows x64-based or Windows Arm64-based systems:

if you have downloaded yet please download from client VPN Endpoints.

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/49a241ab-ce6d-4f34-b61b-6395518a90a8.png align="center")

*   Open the AWS VPN Client app.
    
*   Choose File, Manage Profiles.
    
*   Choose Add Profile.
    
*   For Display Name, enter a name for the profile.
    

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/724f5360-119d-40ca-b660-e43af82a46d4.png align="center")

*   For VPN Configuration File, browse to and then select the configuration file that you received from your Client VPN administrator, and choose Add Profile.
    

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/ee7d8173-bf00-4041-80e3-389af5b6c09e.png align="center")

I have created an AWS EC2 instance on Private Subnet which has private IP **192.168.128.81** and with security group with ICMP and SSH Protocol allowed.

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/e5e44539-c6de-49dc-bcc2-bd1c83f927c8.png align="center")

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/5cfdcbe0-6e3c-4c53-8202-74c05bc8c6e2.png align="center")

The instance is reachable from the VPN client and can also access the internet, which is enabled by the **split-tunnel configuration** that we have implemented.

Once connected, We can also see the Connection that had been created on the Client VPN Endpoint, under the connections tab.

![](https://cdn.hashnode.com/uploads/covers/6459e94af9c6f511b4f65264/6a07abbd-4099-4349-97d3-decd4231d7d4.png align="center")

**Congratulations!!**

This confirms that the VPN connection has been successfully established and that the instance in the private subnet is reachable. You can now securely connect to the server via SSH using the instance’s private IP address.

```plaintext
chmod 400 <path-to/keyfile.pem>
ssh -i <path-to/keyfile.pem> <userName>@<privateIP>
```

The chmod 400 command ensures that the private key has the required permissions. The SSH username depends on the operating system/AMI used by the EC2 instance for example, ec2-user for Amazon Linux, ubuntu for Ubuntu, and admin for some Debian-based images. Replace with the appropriate username for your instance.

### Benefits

*   **Security** : Implements enterprise-grade security with certificate-based authentication
    
*   **Flexibility** : Connects AWS and on-premises resources
    
*   **Scalability** : Automatically scales based on you needs
    
*   **Managed Service** : AWS handles the infrastructure, We just focus on the configuration
    

**<mark class="bg-yellow-200 dark:bg-yellow-500/30">NOTE:</mark>**

*If you ever change settings like enabling split-tunnel or adding new routes, Please make sure to re-download the client config file and reconnect otherwise, your local profile might not reflect the new routing.*

### Conclusion

AWS Client VPN with mutual authentication provides a secure, controlled, and scalable way to access private resources without exposing them to the public internet. With the right configuration, secure remote access becomes simple, reliable, and production-ready.