Lecture 113: Hands On: Set up AWS Client VPN
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：22:15
- 来源：Udemy Lecture 54982297
- Slide 数量：21
- 画面切换：00:04、01:03、01:59、03:19、03:58、06:41、07:24、07:55、08:57、09:46、10:21、11:32、12:08、14:40、15:26、16:50、17:43、18:12、19:32、20:28
扫描说明
逐条检查了 Udemy 页面中的 308 条 Transcript cue，并以每条 cue 对应画面为时间轴扫描了全长约 22:15 的视频。依据独立幻灯片与证书生成、ACM 导入、VPC 和子网、路由表、安全组、EC2、Client VPN 端点、目标网络、授权、客户端下载与验证等具有明确目标的实操阶段，共划分为 21 个小节。所有正式截图均在对应 cue 播放后等待播放器控件消失，再按视频真实画面边界截取为 1364×770，并逐张复核左右及底部完整性。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 实验目标：搭建 AWS Client VPN
时间范围：00:00–00:04
总结 / Summary
中文
本实验将从零搭建 AWS Client VPN，使本地客户端能够通过私有地址访问 VPC 内的应用实例。后续步骤会覆盖证书、网络、安全、端点配置以及最终连通性验证。
English
This exercise builds AWS Client VPN from scratch so a local client can reach an application instance in a VPC through its private address. The workflow covers certificates, networking, security, endpoint configuration, and final connectivity testing.
Transcript
00:00 All right, so now let's do this exercise and let's set up AWS client VPN.
2. 目标架构与关键组件
时间范围：00:04–01:03
总结 / Summary
中文
目标 VPC 包含应用子网（application subnet）和目标网络子网（target network subnet）。客户端通过客户端 VPN 端点（Client VPN endpoint）连接，使用 X.509 证书执行双向认证（mutual authentication），再依次通过授权规则（authorization rule）、端点路由（endpoint route）和安全组（security group）访问应用实例。
English
The target VPC contains an application subnet and a target network subnet. A client connects through a Client VPN endpoint, authenticates mutually with X.509 certificates, and then reaches the application instance through authorization rules, endpoint routes, and security-group controls.
Transcript
00:04 And for this exercise, our target architecture will be like this.
00:09 So, on the left side, we have the VPC in which we will have application subnet
00:13 and the target network subnet for the AWS client VPN.
00:17 Now, the goal of this exercise is to access this EC2 instance here
00:22 over its private IP from our client machine, which is your laptop.
00:27 And for having this connectivity, we will set up AWS client VPN endpoint.
00:32 Further, for the authentication of the users,
00:35 we will use mutual authentication using the X.509 certificates.
00:41 So, for this, we will have to generate the server certificate.
00:44 And also for every client, we need to generate a client certificate.
00:48 And further, in order to secure this connectivity,
00:51 we will have the security group in the target network.
00:54 Further, we will have the routes in the AWS client VPN endpoint.
00:57 And additionally, we will have authorization rules configured.
01:01 So, we are going to follow all these steps.
3. 避免 CIDR 地址重叠
时间范围：01:03–01:59
总结 / Summary
中文
VPC CIDR、子网 CIDR 和客户端 CIDR（client CIDR）不能与本地局域网地址范围（local-area network range）重叠，否则路由选择可能把流量送往错误接口。实验先用 Windows 的 ipconfig 确认本地网络位于 192.168.0.0/16 范围，再为 VPC 与客户端地址池分别选择 10.10.0.0/16 和 10.20.0.0/16。
English
The VPC, subnet, and client CIDR ranges must not overlap the local LAN range, or route selection may send traffic to the wrong interface. The exercise checks the Windows network with ipconfig, finds it in 192.168.0.0/16, and therefore uses 10.10.0.0/16 for the VPC and 10.20.0.0/16 for clients.
Transcript
01:03 But before we get started, one important thing to notice that
01:06 when you configure the CIDR ranges for your VPC subnets and this client CIDR,
01:12 make sure that they do not overlap with your local area CIDR range.
01:17 Now, what do I mean by that?
01:19 So, I am using the Windows machine and if I do say ipconfig,
01:24 it shows me my local area network CIDR range.
01:27 And this falls under 192.168 range.
01:30 So, avoid using these ranges for your VPC and the client CIDR ranges.
01:36 And I am also going to do the same.
01:38 So, if you are doing the exercise, make sure that you use any other private IP ranges
01:43 other than what is your local network address.
01:47 And for the same reason, in this exercise, I am using 10.10.0.0 range for the VPC CIDR
01:54 and 10.20.00 range for the client CIDR. All right.
4. 完整实验步骤
时间范围：01:59–03:19
总结 / Summary
中文
实验流程依次是：生成服务端与客户端证书并导入 AWS Certificate Manager（ACM）、创建 VPC/子网/路由表、建立安全组（security group）和 EC2 实例、创建并关联客户端 VPN 端点（Client VPN endpoint）、配置路由与授权规则（authorization rule）、下载客户端配置，最后通过 EC2 私有 IP 验证连接。
English
The lab sequence is to generate server and client certificates and import them into ACM; create the VPC, subnets, and route tables; configure security groups and an EC2 instance; create and associate the Client VPN endpoint; add routes and authorization; download the client configuration; and verify access to the EC2 private IP.
Transcript
01:59 So, the high level step for this exercise will be this.
02:03 First, we will create the X.509 certificate and the keys for the server as well as the client.
02:09 And then we will import that into the ACM.
02:12 Then we will set up the VPC subnets and the security groups.
02:16 Next, we will create the client VPN endpoint and then
02:19 we will associate that endpoint with the target network subnet in the VPC.
02:24 Additionally, we will create the routes and the authorization rules for the client VPN.
02:29 Once the VPN is configured on the AWS side, we will download the client VPN configuration file
02:35 and use that file to configure your local client VPN software.
02:40 Now, it is up to you which local client VPN you use.
02:43 But for this exercise, I am using the OpenVPN client.
02:47 However, AWS now also provides its own client VPN software.
02:51 So, if you want, you can also download those and install into your local machine. All right.
02:57 So, once we configure the client VPN locally, we will just test the connectivity
03:01 to the EC2 instance using its private IP. Right.
03:06 So, those are all the steps that we are going to do.
03:08 And now, let's get started with the first step, where we will create the certificates
03:13 for the server and the client, and we will import those certificates into the ACM.
5. 证书生成与导入准备
时间范围：03:19–03:58
总结 / Summary
中文
双向认证（mutual authentication）需要证书颁发机构（Certificate Authority, CA）、服务端证书和每位客户端各自的证书。课程使用 Easy-RSA 在 Linux 或 macOS 环境初始化公钥基础设施（Public Key Infrastructure, PKI），随后把证书与私钥整理到同一目录，并导入与 VPC 相同区域的 ACM。
English
Mutual authentication requires a Certificate Authority, a server certificate, and a separate certificate for each client. The lab uses Easy-RSA on Linux or macOS to initialize a PKI, collects the certificates and private keys in one directory, and imports them into ACM in the same Region as the VPC.
Transcript
03:19 Now, in order to generate this certificate, you need any kind of Linux machine,
03:23 which can be any EC2 instance, or if you are using the Linux or Mac,
03:27 you can also execute all these commands onto your Linux or Mac instance.
03:32 Ultimately, what we are doing, we are generating the certificate and the keys
03:36 for the server and the client, and we are inputting those into the ACM.
03:41 Now, all these steps are also given in the AWS documentation.
03:44 So, if you feel comfortable, you can also refer to that.
03:48 But overall, these are all the seven steps that you need to follow
03:51 to generate and import these certificates.
03:54 So now, let me also do these steps. All right.
6. 使用 Easy-RSA 生成证书
时间范围：03:58–06:41
总结 / Summary
中文
命令行首先克隆 Easy-RSA、初始化 PKI 并创建 CA，然后分别生成服务端证书和客户端证书。每位用户应使用独立的客户端证书（client certificate），以便人员离职或凭证泄露时能够单独吊销；最后把 CA、证书和私钥复制到实验目录。
English
The terminal workflow clones Easy-RSA, initializes the PKI, creates the CA, and generates server and client certificates. Each user should receive a separate client certificate so it can be revoked independently when an employee leaves or credentials are compromised. The CA, certificates, and keys are then copied into the lab directory.
Transcript
03:58 So, let me fire the first command, where it installs the ECRSA.
04:07 All right.
04:08 Next, let's go to the ECRSA directory.
04:10 And now, let's fire the ECRSA commands.
04:13 So, here let's initialize the PKI, that is public key infrastructure. All right.
04:19 So, first thing we need to create the certificate authority, that is CA.
04:23 So, using this process, we are going to create a CA, and here we can give any name.
04:28 For example, it's my demo CA.
04:31 So, that should be good enough. All right.
04:34 Let me clear the screen.
04:36 Next, first we need to create the server certificate, and this is a command for that.
04:40 So, let's create the server certificate.
04:43 And let's just say yes.
04:46 And it created the server certificate, that is server.crt. All right.
04:52 Next, let's create the client certificate similarly, and then we will keep everything
04:58 into the demo directory, where we'll copy the CA certificate, then the server certificate,
05:02 and the client certificate with their keys into this folder.
05:06 And finally, we will upload the server certificate, its private key to the ACM, as well as the
05:12 client certificate and the key to the ACM.
05:15 So, now let's do this. All right.
05:17 So, now let's create the client certificate, and just say yes.
05:22 And it should create the client one certificate.
05:25 Now, for every client, you should have a separate certificate.
05:28 For example, if there are say 100 employees, then you will have separate client certificate
05:33 for each employee, because then if someone leaves the company, then you can invalidate
05:39 that certificate into the ACM, and then that user won't be able to log in using that client certificate.
05:46 So, here because I just have my machine, I'm just creating one client certificate. All right.
05:53 So, let me clear the screen again.
05:57 And let me create a new directory where I can collect now all these certificates and
06:00 the keys together.
06:01 So, let me create a new directory in my home directory called say demo.
06:07 And now I will copy all these files into this demo directory.
06:11 Okay, so let's first copy the CA certificate, then the server certificate, then let's copy the server key.
06:21 Similarly, the client certificate and the client key. All right.
06:27 Now, finally, let's go to this demo directory and let's see if we can see all these files.
06:33 All right, I can see everything.
06:35 And now let's import these certificates and the keys into the Amazon Certificate Manager.
7. 将服务端与客户端证书导入 ACM
时间范围：06:41–07:24
总结 / Summary
中文
使用 AWS CLI 的 ACM 导入命令分别上传服务端证书及私钥、客户端证书及私钥，并附带同一个 CA 的证书链（certificate chain）。ACM 区域（Region）必须与稍后创建 VPC 和 Client VPN 的区域一致；实验使用 Mumbai 区域。
English
AWS CLI ACM import commands upload the server certificate and private key, then the client certificate and private key, with the certificate chain from the same CA. ACM must be in the same Region as the VPC and Client VPN; this lab uses the Mumbai Region.
Transcript
06:41 Now, while you do so, one thing to note is that you should use the same region in which
06:45 you have the VPC and the AWS client VPN.
06:49 So, for inputting the certificate, you will use the ACM in the same AWS region.
06:54 Now, in my case, I am using the Mumbai region and that's where you will see AP Southwind
06:59 as the region provided.
07:01 So, let me import first the server key here and the server certificate.
07:07 So, as you can see here, the server certificate and the key has been imported into the ACM.
07:12 And now let's do the same for the client certificate and the key. All right.
07:16 So, all the steps for creating and importing the certificate and the keys have been completed. Okay.
8. VPC、安全组与测试实例设计
时间范围：07:24–07:55
总结 / Summary
中文
网络部分将创建一个 VPC、两个私有子网（private subnet）以及各自的路由表（route table）：应用子网承载测试 EC2，Client VPN 子网承载目标网络关联。Client VPN 安全组只需出站规则，应用实例的入站规则则以该安全组为来源，从而只允许经 VPN 到达的流量。
English
The network stage creates one VPC, two private subnets, and separate route tables: the application subnet hosts the test EC2 instance, while the Client VPN subnet is used for the target network association. The Client VPN security group needs outbound access, and the application instance accepts inbound traffic sourced from that security group.
Transcript
07:24 So, next, we need to set up the VPC now.
07:27 And in there, we will create the VPC with two private subnets.
07:31 And then we will also create a security group for this client VPN endpoint.
07:37 And in that security group, we just need to have the outbound rule.
07:40 And further, when we launch the EC2 instance here,
07:43 we will make sure that it allows all the traffic from this particular security group.
07:48 So, again, all the steps are given in the slides and I'm just going to follow the same. Okay.
9. 创建 VPC 与两个私有子网
时间范围：07:55–08:57
总结 / Summary
中文
实验创建 10.10.0.0/16 的 demo VPC，不附加互联网网关（Internet Gateway, IGW），随后在同一可用区（Availability Zone, AZ）建立 10.10.0.0/24 的应用子网和 10.10.100.0/24 的 Client VPN 目标网络子网。两个子网都保持私有。
English
The lab creates demo VPC with 10.10.0.0/16 and no Internet Gateway, then creates a 10.10.0.0/24 application subnet and a 10.10.100.0/24 Client VPN target-network subnet in the same Availability Zone. Both subnets remain private.
Transcript
07:55 So, I'm into my VPC console in the Mumbai region.
07:57 And first thing, let me create a new VPC and let me call it a demo VPC.
08:03 And the CIDR range is 10.10.0.0 slash 16.
08:08 Rest of the settings as it is.
08:10 Now, at this moment, I'm not creating the internet gateway because we don't need that.
08:14 So, next, let's go to the subnets and let's create new subnets for this VPC.
08:20 So, the first subnet is for the application.
08:23 So, let's call it demo app.
08:25 And let's use one of the AC there.
08:27 And the CIDR range is 10.10.0.0 slash 24.
08:34 Let's add one more subnet.
08:35 And that's for the client VPN endpoint.
08:37 So, let's call it demo client VPN in the same AC and let's give it a different range 10.10.100.0
08:50 slash 24. That's it.
08:53 Let's create the subnets.
08:56 All right.
10. 创建并关联独立路由表
时间范围：08:57–09:46
总结 / Summary
中文
为应用子网和 Client VPN 子网分别创建路由表（route table），并显式完成子网关联（subnet association）。初始阶段只保留 VPC 的本地路由（local route），但独立路由表便于后续针对两个流量域分别添加或排查路由。
English
Separate route tables are created and explicitly associated with the application and Client VPN subnets. Only the VPC local route is required initially, but independent tables make later route changes and troubleshooting easier for each traffic domain.
Transcript
08:57 Next, let's create the root tables for this subnet.
08:59 So, let's create a new root table for the VPC.
09:03 So, let's create a new root table for the demo app subnet in the same VPC.
09:10 And as of now, we don't need to add any root, but just let's make sure that we
09:14 associate that with the demo app subnet. All right.
09:19 Similarly, let's create another root table so that we can control the roots later.
09:24 And let's call it demo client VPN root table in the same VPC.
09:32 And here also, we don't need to add any roots, but let's make sure that we attach it to the right subnet. All right.
09:40 So, if you see this diagram, we are done with the VPC and these two subnets and the root tables.
11. 创建 Client VPN 安全组
时间范围：09:46–10:21
总结 / Summary
中文
为客户端 VPN 端点创建专用安全组（security group），不配置入站规则（inbound rule），保留允许所有 IPv4 流量的出站规则（outbound rule）。该安全组稍后附加到目标网络中的 ENI，并作为应用实例入站规则的可信来源。
English
A dedicated security group is created for the Client VPN endpoint with no inbound rules and the default allow-all IPv4 outbound rule. It is later attached to the target-network ENI and referenced as the trusted source in the application instance's inbound rule.
Transcript
09:46 Next, let's create a security group for the client VPN.
09:51 So, you can create that from the VPC console or EC2 console, but let's do it from here only.
09:57 So, let's create a new security group and let's call it demo
10:02 client-vpn-sg allow-all-traffic and this should be in the demo VPC.
10:11 And here we need to just have the outbound rule, which is already there for IPv4.
10:15 So, we are just going with that.
10:17 So, let's create this security group. All right.
10:20 So, that's also done.
12. 启动私有 EC2 测试实例
时间范围：10:21–11:32
总结 / Summary
中文
测试 EC2 实例部署到 demo-app 私有子网，并禁用公有 IP（public IP）。实例安全组（instance security group）允许来自 Client VPN 安全组的所有流量，而不是开放给任意 CIDR；这样既能验证私有连通性，也保留最小化信任边界。
English
The test EC2 instance is launched in the private demo-app subnet with no public IP. Its instance security group allows traffic from the Client VPN security group rather than from an arbitrary CIDR, providing a controlled path for testing private connectivity.
Transcript
10:21 And now we need to launch the EC2 instance, which is just for testing the connectivity.
10:26 So, let's launch the instance in the same VPC that we created.
10:31 And let's call it demo-app-instance with most of the configurations as default,
10:40 just that we need to make sure that we create that in the right subnet.
10:44 So, in the network, let's select the demo VPC and we need to select the demo-app-subnet.
10:51 Now, here we don't need the public IP for this instance.
10:53 So, let's go with the disabled option and in the security group, let's call it demo-app-security
10:59 group and as a rule, as I said, it should allow all the traffic from the client VPN security group.
11:07 So, source will be custom and here you should have the security group for the demo client VPN.
11:15 That's it really.
11:16 We don't need to do any other changes and let's launch the instance.
11:21 All right.
11:22 So, it will take some time for this instance to be up and running and by that time, we can
11:28 probably proceed with creating the client VPN endpoint.
13. 规划客户端地址池
时间范围：11:32–12:08
总结 / Summary
中文
客户端 CIDR（client CIDR）是 VPN 为每台连接设备分配地址的独立地址池。本实验选择 10.20.0.0/16；它既不能与 VPC 地址范围重叠，也不能与客户端所在 Wi-Fi/局域网重叠，否则客户端路由会产生歧义。
English
The client CIDR is a separate address pool from which the VPN assigns an address to each connected device. The lab uses 10.20.0.0/16, which must overlap neither the VPC ranges nor the client's Wi-Fi or LAN network, or client-side routing becomes ambiguous.
Transcript
11:32 So, we are done with all these steps and now let's create the client VPN endpoint and while
11:38 creating the endpoint, we need to provide the CIDR range for the client side of the network.
11:42 Now, this IP range will be used to assign a separate IP address for every client that
11:48 connects using the same client VPN endpoint.
11:51 So, in your company, if there are say thousands of employees, then every employee machine
11:55 will get a separate IP from this CIDR range and that's where I said it should not overlap
12:00 with this range as well as your Wi-Fi's local area network.
12:05 So, just take care of that. All right.
14. 创建 Client VPN Endpoint
时间范围：12:08–14:40
总结 / Summary
中文
创建客户端 VPN 端点（Client VPN endpoint）时选择 demo VPC、专用安全组、IPv4 地址族和 10.20.0.0/16 客户端 CIDR。认证方式采用证书双向认证（certificate-based mutual authentication），服务端证书与客户端证书由同一 CA 签发，因此可在客户端根证书链位置选择服务端证书；传输协议（transport protocol）选用 TCP。
English
The Client VPN endpoint is configured for demo VPC with the dedicated security group, IPv4, and client CIDR 10.20.0.0/16. It uses certificate-based mutual authentication. Because the server and client certificates share the same CA, the server certificate can represent the client root chain. TCP is selected as the transport protocol.
Transcript
12:08 So, now let's create this client VPN endpoint and for this again, we need to go to the VPC
12:14 console and if you just scroll down and go to the VPN section, you will see the client VPN endpoints.
12:20 So, let's create our endpoint and let's call it say client VPN endpoint.
12:28 Now, we are going to attach that to the VPC.
12:31 So, let's select our demo VPC there and the security group is the one that we had created. All right.
12:38 Now, which type of the IP address you want to allocate?
12:41 As of now, we are doing this exercise only with IPv4 addresses because even our VPC has
12:46 only IPv4 addresses.
12:47 So, let's go with that.
12:49 But it supports IPv4, IPv6 and even dual stack.
12:52 That means both type of the IP addresses.
12:55 So, let's go with IPv4 here and same for the traffic as well.
12:59 Now, here we need to provide the client IPv4 CIDR range.
13:03 So, we will provide 10.20.0.0 slash 16. All right.
13:09 Now, for the authentication, we are going to use the mutual authentication and first
13:14 thing we need to provide the certificate for the client VPN itself.
13:17 So, let's provide the server certificate and now for the client authentication, again
13:22 we are using the client certificate based authentication.
13:25 So, let's use this first option.
13:28 But otherwise, if you are using the active directory for the user management, then you
13:32 would have to provide your directory ID, but we don't have that.
13:36 So, let's go with the certificate based authentication.
13:39 And here for this client certificate, basically you can provide both either server certificate
13:44 or the client certificate.
13:45 And the way it works is that if both the certificates are signed by the same CA, that
13:49 is certification authority, then better you provide the server certificate here.
13:54 However, if the client certificates are issued by the different CA, then you would have to
13:59 add the client certificate itself.
14:01 So, as of now, I can only go with the server certificate. All right.
14:06 Next, there are a lot of other options, but we are not going to look into that as of now.
14:12 Just probably one more thing that I want to show is about the transport protocol, which
14:18 could be TCP or UDP, but let's go with the TCP here.
14:21 And later I will talk about this full tunnel mode and the split tunnel mode.
14:26 And we will hopefully do the exercise as well for that.
14:30 Okay, so that's it about the client VPN endpoint setting.
14:33 So, let's just create that.
14:36 Okay, so it will take some time for getting created.
15. 关联目标网络子网
时间范围：14:40–15:26
总结 / Summary
中文
端点创建后必须与 VPC 中的目标网络子网（target network subnet）关联。本实验选择 demo-client-vpn 子网；关联过程会为端点建立进入 VPC 的网络接入点，并可能需要数分钟完成。
English
After creation, the endpoint must be associated with a target network subnet in the VPC. The lab selects the demo-client-vpn subnet. The association creates the endpoint's network entry into the VPC and can take several minutes to complete.
Transcript
14:40 And the first thing that you should do after creating the endpoint is to associate that
14:45 with the VPC subnet that we created for the client VPN.
14:49 And that is called target network.
14:51 So, let's go here and let's associate the target network and it should be the demo client VPN subnet.
14:59 And let me show you in the diagram what I mean by this.
15:03 So, here I'm talking about this subnet basically, right?
15:06 Okay, so let's associate this network.
15:10 Alright, now this will take maybe a few minutes for the association of the target network.
15:16 So, let me pause this video for maybe two minutes and I will come back.
15:21 Alright, so it took around like five minutes for this client VPN endpoint to be up and running.
16. 配置授权规则与端点路由
时间范围：15:26–16:50
总结 / Summary
中文
授权规则（authorization rule）允许所有已认证用户访问目标 VPC CIDR。目标网络关联会自动在客户端 VPN 路由表（Client VPN route table）中加入对应 VPC 路由；如果还要访问对等 VPC（peered VPC）或经互联网网关出网，则必须手工添加相应端点路由，并为目标网段配置匹配的授权。
English
An authorization rule allows all authenticated users to reach the target VPC CIDR. The target-network association automatically creates the corresponding route in the Client VPN route table. Access to a peered VPC or the internet through an Internet Gateway requires additional endpoint routes and matching authorization.
Transcript
15:26 Alright, so client VPN endpoint has been created and now we need to do some additional configurations.
15:32 So, there we need to create the authorization rule here to allow the clients to connect
15:38 to this network, as well as we need to also add the route in the client VPN route table
15:44 to allow access to this network.
15:47 Okay, so for that, again, let's go to the authorization rules here and let's create a new rule.
15:52 And the destination for us is either you can put the particular subnet CIDR or you can
15:59 also give your VPC CIDR range as a target network.
16:04 And let's allow all the users and let's say allow all users and create this authorization rule.
16:12 Now, similarly, we need to also create the route entry for the same CIDR range, but because
16:18 we have associated the target network, it automatically creates that.
16:23 However, for example, if you have a peered VPC and you want to allow access to that peered
16:27 VPC, then you would have to come here and also add that route manually.
16:32 Further, if you want to allow the internet access through the internet gateway of the
16:37 VPC, then also you would have to come here and add the route saying that 000 traffic
16:43 goes through the internet gateway.
16:46 Okay, so with that, we are done with the client VPN endpoint setup.
17. 客户端下载配置文件的更新方法
时间范围：16:50–17:43
总结 / Summary
中文
从端点下载 OpenVPN 配置文件后，必须把客户端证书和私钥信息加入其中。可以在 <cert> 与 <key> 标签内嵌入完整内容，也可以使用 cert 和 key 指令引用本地文件路径；实验选择第二种方式。
English
After downloading the OpenVPN configuration from the endpoint, the client certificate and private key must be added. Their full contents can be embedded inside <cert> and <key> tags, or cert and key directives can reference local files. The lab uses the file-path method.
Transcript
16:50 And now we just need to download the configuration file and configure the local client VPN.
16:57 So the steps are simple.
16:58 We need to download the VPN configuration file from the AWS and use that configuration
17:03 file to configure the open VPN client in our local machine.
17:07 So now let's do this.
17:10 And all the steps again for this are given here.
17:13 The most important thing here is to add the client certificate and the key in that VPN
17:19 configuration file.
17:20 And you can do that by one of the two methods.
17:23 Either you can paste the entire certificate and the key content in this tags here.
17:29 Or if you have the certificate and key stored as a file, then you can just add these two
17:34 entries pointing to your files.
17:37 And I'm going to use this second method.
17:40 All right, so let's now do this.
17:43 So from here, you can download the configuration.
18. 下载 Client VPN 配置
时间范围：17:43–18:12
总结 / Summary
中文
AWS 控制台可直接下载客户端配置（client configuration）。如果不使用 OpenVPN，也可以从同一页面获取 AWS 提供的桌面 VPN 客户端；本实验已安装 OpenVPN，因此保存端点生成的配置文件供下一步修改。
English
The AWS console downloads the endpoint's client configuration directly. The same page also links to AWS-provided desktop VPN clients for users who do not use OpenVPN. This lab already has OpenVPN installed and saves the generated configuration for editing.
Transcript
17:45 But before that, I just wanted to show you that if you don't want to use open VPN client,
17:50 but rather you want to use AWS provided VPN clients into your local machine, then you
17:53 can just follow these links and install those clients.
17:58 So I'm using open VPN and I have already installed that into my local machine.
18:03 So let's download this configuration file.
18:07 And let's store it locally.
18:10 All right, it's there.
19. 编辑并导入 OpenVPN 配置
时间范围：18:12–19:32
总结 / Summary
中文
打开 .ovpn 配置文件，保留端点 DNS 名称（endpoint DNS），再加入客户端证书文件和私钥文件的本地路径。保存后将该文件导入 OpenVPN 客户端，形成可用于连接 AWS Client VPN 的本地连接配置。
English
The .ovpn file keeps the endpoint DNS name and adds local paths to the client certificate and private-key files. After saving, the file is imported into OpenVPN to create the local connection profile for AWS Client VPN.
Transcript
18:12 And now let's open this VPN configuration file.
18:16 All right, so let me open this with simply the notepad.
18:19 Okay, so this is how the file looks like.
18:21 And the important thing here is the endpoint DNS.
18:24 So of course, we don't need to change that.
18:27 And additionally, we need to just add the certificate and the key file for the client.
18:33 And I have my client certificate and the key file stored locally into my machine.
18:38 So I will just add corresponding paths in the VPN configuration file.
18:43 Okay, so the first let me add the cert.
18:46 And let me paste the path.
18:49 And let's use single code because that's better.
18:55 And similarly, let's add the key as well.
18:59 And again, I need to copy the path of the key file.
19:08 So let me just paste it here and remove this double quotes.
19:15 And save this file.
19:16 All right, so everything is done.
19:19 We just need to go to the VPN client and import this file.
19:23 So let's say import, import file and import.
19:30 Okay, file has been imported.
20. 连接并验证私有 IP 可达性
时间范围：19:32–20:28
总结 / Summary
中文
连接 OpenVPN 后，客户端从 10.20.0.0/16 地址池获得 VPN 地址。对私有 EC2 地址 10.10.0.40 的 ping 全部成功且无丢包，证明证书认证、目标网络关联、路由、授权规则和安全组共同形成了完整的数据路径（data path）。
English
After OpenVPN connects, the client receives a VPN address from 10.20.0.0/16. Pings to the private EC2 address 10.10.0.40 succeed with no loss, confirming that authentication, target-network association, routing, authorization, and security groups form a working end-to-end data path.
Transcript
19:32 The next thing that we need to do is to basically connect.
19:36 But before that, we need to get the IP address of the EC2 instance so that I can ping it from my laptop.
19:41 So let's go to the AWS console and grab that IP.
19:44 Okay, so let's go here and let's go to the instances.
19:51 And this is the private IP 10.10.0.40. All right.
19:56 So now let's go here and let's just say connect.
20:02 And it should show the logs, which says that it has been connected.
20:05 And you can see the IP address has been assigned from the client side range,
20:09 which was in the range of 10.20.
20:12 So now let's go here and let me clear the screen.
20:17 And let's ping to the EC2 instance IP address.
20:20 And you can see that I am able to ping to it.
20:23 So which means that we are able to successfully set up the client VPN connectivity.
21. 全隧道模式下的互联网与 DNS 问题
时间范围：20:28–22:15
总结 / Summary
中文
私有 VPC 连通后，公网 IP 和域名仍无法访问。原因是端点当前采用全隧道模式（full-tunnel mode），客户端的所有流量（包括互联网流量）都进入 VPN，但 VPC 尚未配置通向互联网的出口，同时 DNS 解析（DNS resolution）也未完善；下一讲将沿用该环境修复互联网访问。
English
Private VPC connectivity works, but public IPs and domain names remain unreachable. The endpoint currently uses full-tunnel mode, so all client traffic, including internet traffic, enters the VPN, while the VPC has no configured internet egress and DNS resolution is not yet complete. The next lecture continues from this environment to enable internet access.
Transcript
20:28 Now, before we stop for this exercise, let's explore a few additional things.
20:32 For example, let's try to ping the Google's DNS server, which is publicly available at
20:37 this IP address. And we can't.
20:40 Now, do you know why?
20:42 Or let's try to get say wget https google.com.
20:51 Or I think curl might work.
20:55 However, this time the error is not related to the internet traffic, but rather it's a DNS error.
21:00 That means there are two problems.
21:02 We are not able to access the internet and we are also not able to resolve the DNS.
21:07 Now, the DNS problem we will fix a little later.
21:09 But before that, we need to fix this problem of accessing the internet.
21:13 Now, if you see why we are not able to access the internet, the reason for that is currently
21:18 this AWS client VPN is set up in a full tunnel mode.
21:21 That means all the traffic from the client machine is going through the client VPN, including
21:27 the internet traffic.
21:29 However, we haven't configured any way to go out to the internet from here.
21:33 As of now, we can only access this VPC subnets.
21:37 And that's where we are not able to access the internet from my local machine.
21:42 So, as of now, with this setup, I can't even access google.com because this traffic is
21:47 going through the client VPN endpoint and internet traffic is dropped. Right.
21:52 So, that's the first problem that we need to fix.
21:54 And then we will fix the problem of DNS resolution as well.
21:58 So, that's it about this exercise.
22:00 And now in the next exercise, we will see how to enable internet access to the client machine.
22:05 And for that exercise, I will continue with this existing setup. All right.
22:10 With that, now let's go to the next exercise.
整讲总结 / Overall Summary
中文
本讲完成了一套可工作的 AWS Client VPN：使用 Easy-RSA 与 ACM 实现证书双向认证（certificate-based mutual authentication），搭建隔离的 VPC 子网与安全组，创建端点并关联目标网络，配置授权和路由，再通过 OpenVPN 访问私有 EC2。实验也揭示了全隧道模式（full-tunnel mode）下必须额外设计互联网出口与 DNS 解析的问题。
English
This lecture builds a working AWS Client VPN using Easy-RSA and ACM for certificate-based mutual authentication, isolated VPC subnets and security groups, a target-network association, endpoint authorization and routing, and an OpenVPN client that reaches a private EC2 instance. It also exposes the additional internet-egress and DNS requirements introduced by full-tunnel mode.
返回顶部 ↑