Lecture 112: Introduction to AWS Client VPN
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:27
- 来源：Udemy Lecture 54982317
- Slide 数量：7
- 画面切换：00:08、00:36、01:00、02:00、02:21、07:10
扫描说明
逐条检查了 Udemy 页面中的 102 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 7:27 的视频。依据标题、混合连接选项、客户端 VPN 概念、AWS Client VPN 可达范围、组件清单、组件工作流程及限制条件七张独立幻灯片，共划分出 7 个小节。扫描过程中出现的临时播放器错误遮罩已在正式截图前关闭；最终图片均重新截取并逐张核对。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. AWS Client VPN 概览
时间范围：00:00–00:08
总结 / Summary
中文
AWS Client VPN 是面向单个终端用户的托管远程访问 VPN（remote-access VPN）。它与连接两张网络的站点到站点 VPN（Site-to-Site VPN）不同，重点是让笔记本电脑等客户端设备安全、私密地进入 AWS 或企业网络。
English
AWS Client VPN is a managed remote-access VPN for individual endpoint users. Unlike Site-to-Site VPN, which connects two networks, it securely and privately brings client devices such as laptops into AWS or corporate networks.
Transcript
00:00 Alright, so now let's talk about AWS Client VPN.
00:04 So until now, we have talked about the site-to-site VPN connection.
2. 混合连接中的两种 VPN
时间范围：00:08–00:36
总结 / Summary
中文
在混合连接（hybrid connectivity）中，AWS 站点到站点 VPN（AWS Site-to-Site VPN）把企业数据中心的整个网络连接到 VPC，使数据中心内的用户和服务器访问云中资源；AWS Client VPN 则让单个远程客户端直接建立加密连接。当用户在家办公或从外部地点访问 VPC 资源时，应选择客户端 VPN（Client VPN）。
English
In hybrid connectivity, AWS Site-to-Site VPN connects an entire corporate data-center network to a VPC, allowing its users and servers to reach cloud resources. AWS Client VPN instead creates an encrypted connection for an individual remote client. It is the appropriate choice when a user works from home or another external location and needs private VPC access.
Transcript
00:08 And in there, we basically connect our network to the AWS VPC.
00:13 And then all the users or servers deployed in your corporate data center can access the
00:17 VPC resources privately.
00:20 So that was site-to-site VPN.
00:22 However, if you are working remotely, and if you want to access the VPC resources privately,
00:27 then you should use AWS Client VPN.
00:31 So it is something like this, where you are working from home or from the remote sites,
3. 客户端到企业网络的远程访问
时间范围：00:36–01:00
总结 / Summary
中文
客户端 VPN（Client VPN）让分散在家庭、分支或其他远程地点的用户通过 VPN 软件连接到公司网络（company network），体验类似位于内部网络中的访问方式。客户端通常使用 OpenVPN、Cisco VPN 等兼容软件建立会话，并在认证后访问内部服务器、数据库和应用。
English
A Client VPN lets users in homes, branches, or other remote locations connect to a company network as though they were on the internal network. Clients commonly use compatible software such as OpenVPN or Cisco VPN, authenticate, and then access internal servers, databases, and applications.
Transcript
00:36 you get access to your company network.
00:39 And then you can access the resources inside that network.
00:43 And I'm sure during the COVID time, you must have used Client VPN.
00:48 And for this, typically you will use the Client VPN softwares like OpenVPN or Cisco VPN like that.
00:55 Alright, so in AWS, the service is AWS Client VPN.
4. Client VPN Endpoint 的可达范围
时间范围：01:00–02:00
总结 / Summary
中文
首先创建客户端 VPN 端点（Client VPN endpoint），客户端连接后即可访问 VPC 内的资源。通过正确的路由（route）和授权规则（authorization rule），访问范围还可扩展到对等 VPC（peered VPC）、VPC 端点服务（VPC endpoint service）、互联网网关（Internet Gateway, IGW），以及通过站点到站点 VPN 连接的本地网络（on-premises network）。端点因此可以成为远程用户进入多张关联网络的统一入口。
English
A Client VPN endpoint is created first, after which connected clients can reach resources in the VPC. With the correct routes and authorization rules, access can extend to peered VPCs, VPC endpoint services, the internet through an Internet Gateway, and on-premises networks connected by Site-to-Site VPN. The endpoint can therefore serve as one remote-user entry point to several related networks.
Transcript
01:00 And as this diagram shows, in order to connect to the VPC resources, you first create the
01:05 Client VPN endpoint.
01:07 And shortly, we are going to discuss in detail how exactly it works.
01:11 But at high level, you can access all the resources inside the VPC over this Client VPN connection.
01:17 And also, further, you can connect to the other networks which are connected to this VPC.
01:22 For example, if you have other VPCs paired with VPC, or if you have VPC endpoint services
01:28 configured, or if you have the internet gateway, then you can also access the internet through this VPC.
01:35 And finally, if this VPC is connected to other on-premises network over the site to site
01:40 VPN connection, then you can also access that network through this Client VPN endpoint.
01:47 And we are going to talk about all those scenarios once we understand Client VPN in detail.
01:53 Alright, with that, now let's talk about some important components of the Client VPN.
5. AWS Client VPN 组件清单
时间范围：02:00–02:21
总结 / Summary
中文
方案的主要组件包括 VPC、目标网络子网（target network subnet）、客户端 VPN 端点（Client VPN endpoint）、端点路由（route）、授权规则（authorization rule）、客户端 CIDR 范围（client CIDR range）、客户端 VPN 网络接口（Client VPN network interface）、认证系统、授权控制以及客户端软件。认证方式可使用双向证书认证（mutual authentication）、Active Directory（AD）或基于 SAML 的联合身份验证（SAML-based federation）；授权还会结合安全组（security group）和用户/组规则。
English
The main components are the VPC, target network subnet, Client VPN endpoint, endpoint routes, authorization rules, client CIDR range, Client VPN network interfaces, authentication system, authorization controls, and client software. Authentication can use mutual certificates, Active Directory, or SAML-based federation, while authorization also involves security groups and user or group rules.
Transcript
02:00 So as you can see here, there are a lot of components in Client VPN.
02:04 But don't worry, when we do the exercise in the next lecture, we are going to talk about
02:09 all these components.
02:11 But here in this lecture, let me quickly show you how these components work together.
02:17 So for the AWS Client VPN, you need VPC, which you are going to access through the
6. Client VPN 组件如何协作
时间范围：02:21–07:10
总结 / Summary
中文
每个需要高可用的可用区（Availability Zone, AZ）都应选择一个专用目标网络子网（target network subnet）；端点与子网关联后，AWS 会在其中创建弹性网络接口（Elastic Network Interface, ENI）并附加安全组（security group）。客户端从单独的客户端 CIDR（client CIDR）获得地址，连接请求先由双向认证（mutual authentication）、Active Directory 或 SAML/SSO 进行身份认证，再依次检查端点路由表（route table）和授权规则（authorization rule），最后通过 ENI 进入目标网络。路由表决定可达前缀，授权规则决定哪些用户或 AD 组能够访问这些前缀；使用证书双向认证时，授权粒度通常是所有用户统一允许或拒绝，而 AD 组可提供更细的部门级控制。
English
For high availability, select one dedicated target network subnet in each required Availability Zone. Associating the endpoint with a subnet creates an Elastic Network Interface there and attaches a security group. Clients receive addresses from a separate client CIDR. A connection is authenticated through mutual certificates, Active Directory, or SAML/SSO, checked against the endpoint route table and authorization rules, and then enters the target network through the ENI. Routes define reachable prefixes; authorization rules define which users or AD groups may reach them. Certificate-based mutual authentication generally offers all-or-nothing user access, whereas AD groups enable finer departmental control.
Transcript
02:21 Client VPN, and then you need your machine on which you will have your Client VPN software.
02:28 Alright, now further inside the VPC, you should create a Client VPN specific subnet, and that
02:35 is called target network.
02:37 And this is very similar to how you create the transit gateway, and you have a dedicated
02:41 subnet for the transit gateway ENIs.
02:44 So you should have a specific subnet per AZ, if you need high availability for this Client VPN.
02:52 So you will have the subnet.
02:53 And the next thing that you would have is the authentication system.
02:57 Now because this is a Client VPN, you cannot allow anyone to connect to your VPC.
03:02 For this, you must have the authentication system.
03:05 And AWS Client VPN supports different authentication methods.
03:09 For example, certificate based mutual authentication, or Active Directory based authentication,
03:15 or SAML based authentication.
03:18 Now out of this, the simplest will be the mutual authentication using the certificates,
03:22 and that's what we are going to use when we do the lab.
03:25 Alright, so you will have some authentication system, and then you will create the Client VPN endpoint.
03:33 Now as you create this endpoint, you have to configure all these things, for example,
03:38 which is my VPC and which is my target network subnet, then what authentication system you
03:44 are going to use.
03:45 And further, you have to also allocate another CIDR range for your client machines.
03:51 Because when you create a Client VPN, it will allocate a separate IP address to those machines.
03:58 And this CIDR range should not be overlapping with your VPC CIDR range.
04:03 Alright, once you do that, of course, you will associate Client VPN with this target
04:08 network subnet, which essentially will create an ENI into that subnet.
04:13 And as you know, ENI will also have the security group.
04:17 So you would have to configure this security group, and bare minimum, this security group
04:21 should allow the outbound access to the other network that you are going to access through
04:26 this Client VPN.
04:28 Now remember here is that you are not accessing this subnet, but rather other subnets that
04:33 might be there in your VPC.
04:36 Alright, further, for the security reason, you get quite a few controls with the AWS
04:42 Client VPN endpoint.
04:44 So for the security, this AWS Client VPN also comes with its own route table, and through
04:50 which you can control which part of the network on the left side the client can access.
04:56 For example, do you want to allow these users to access the internet through this VPC or
05:01 you want to allow the peered VPC access through this Client VPN endpoint.
05:06 So you can do all those routing configuration in this route table.
05:10 Now additionally, there is also user level authentication that you can implement using
05:15 the authorization rules.
05:17 Now these are more applicable when you are using the active directory, because in there
05:21 you have different groups.
05:23 So you could have group of say people working in the finance department, and you might have
05:28 your application deployed in a separate subnet for the finance application.
05:32 In that case, you can configure that only the users from the finance group can access
05:37 that particular subnet for the finance application.
05:41 So if you want to go that granular, then you can use active directory based authentication.
05:46 If you are using the mutual authentication using the certificate, this authorization
05:50 rule doesn't provide that granular control.
05:53 Rather, you would have to either allow all the users or deny all the users to access
05:58 the target network.
06:00 Right, so for the security, as I said, you can configure this route table as well as
06:04 these authorization rules.
06:07 And finally, you will have your application subnets and now you want to access that through
06:11 this client VPN connection.
06:13 So the client machine will basically initiate the connection by sending the traffic to AWS
06:18 client VPN endpoint, which first will authenticate user using one of the method, and then we'll
06:23 check the routes, we'll check the authorization rule, and we'll then allow the connectivity
06:28 through this ENI.
06:30 And once the traffic lands there, then depending on the target network, you can either access
06:35 internet or any subnets inside this VPC or any other networks connected to this VPC.
06:42 Right, so I hope it is understood.
06:44 And these are all the important components that we would have to use in order to set
06:49 up the client VPN.
06:51 Now before we stop, and before we go to the next lecture where we actually set this up,
06:55 here are a few important things that you need to know about the client VPN.
06:59 And the most important is that when you create the client VPN endpoint, the CIDR range that
07:04 you saw on the right side should not be overlapping with your target network CIDR range.
7. Client VPN 的 CIDR 与子网限制
时间范围：07:10–07:27
总结 / Summary
中文
客户端 CIDR（client CIDR）不能与关联子网所在 VPC 的本地 CIDR 重叠，也不能与手工加入端点路由表的任何路由重叠；其前缀长度必须在 /22 到 /12 之间，并且端点创建后不能修改。一个客户端 VPN 端点（Client VPN endpoint）不能关联同一可用区（Availability Zone, AZ）中的多个子网，因此高可用部署应在不同 AZ 各选择一个子网。课程幻灯片同时指出 AWS Client VPN 支持 IPv4 和 IPv6 流量。
English
The client CIDR must not overlap the local CIDR of the VPC containing an associated subnet, nor any routes manually added to the endpoint route table. Its prefix size must be between /22 and /12, and it cannot be changed after endpoint creation. A Client VPN endpoint cannot associate with multiple subnets in the same Availability Zone, so high availability uses one subnet per distinct AZ. The lecture slide also states that AWS Client VPN supports IPv4 and IPv6 traffic.
Transcript
07:10 So just take care of that while you configure the client VPN.
07:13 Alright, so that's it about this lecture.
07:16 And with that, now let's do an exercise.
07:19 And let's set up this AWS client VPN connectivity.
07:23 So with that, now let's go to the next lecture.
整讲总结 / Overall Summary
中文
AWS Client VPN 为远程用户提供到 VPC 及其关联网络的托管客户端到站点连接（client-to-site connectivity）。设计时必须同时配置目标网络子网（target network subnet）、认证、客户端 CIDR、端点路由、安全组（security group）和授权规则（authorization rule），并严格避免地址重叠；多可用区（multi-AZ）关联可提升可用性。
English
AWS Client VPN provides managed client-to-site connectivity for remote users to a VPC and its connected networks. A complete design coordinates target network subnets, authentication, the client CIDR, endpoint routes, security groups, and authorization rules while strictly avoiding overlapping address ranges. Multi-AZ target-network associations improve availability.
返回顶部 ↑