Lecture 114: Hands On: AWS Client VPN Split Tunnel and remote network
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:18
- 来源：Udemy Lecture 54982327
- Slide 数量：13
- 画面切换：00:26、00:56、01:24、01:55、02:28、03:10、03:52、04:43、06:21、06:39、06:48、06:53
扫描说明
逐条检查了 Udemy 页面中的 100 条 Transcript cue，并以每条 cue 对应画面为时间轴扫描了全长约 7:18 的视频。依据分流隧道、端点修改、连通性测试、OpenVPN DNS 参数修复、VPC 互联网出口、远程 VPC 访问以及资源清理等独立幻灯片或明确实操阶段，共划分为 13 个小节。所有正式截图均从播放中的视频真实画面边界截取为 1364×770，并逐张检查左右及底部完整性。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 通过 Split Tunnel 访问互联网
时间范围：00:00–00:26
总结 / Summary
中文
分流隧道（split tunnel）只把目标 VPC 网段的流量送入 AWS Client VPN，其他互联网流量继续从客户端本地的 Wi-Fi 或以太网出口发送。这样既保留私有 VPC 访问，也避免所有公网流量绕行云端。
English
Split tunnel sends only traffic for the target VPC ranges through AWS Client VPN. Other internet traffic continues through the client's local Wi-Fi or Ethernet gateway, preserving private VPC access without backhauling all public traffic through AWS.
Transcript
00:00 Alright, so how to connect to the internet?
00:02 Now there are two options that you can use for that.
00:05 The first option, you can configure the client VPN in the split tunnel mode.
00:10 Now in that case, what happens is that all the traffic for the VPC will go through the
00:14 AWS client VPN endpoint and rest of the traffic will be routed locally from the client machine
00:20 using your Wi-Fi network or the Ethernet network.
00:24 So it will be something like this.
2. Split Tunnel 实验步骤
时间范围：00:26–00:56
总结 / Summary
中文
启用分流隧道（split tunnel）前，由于当前全隧道连接阻断了互联网，需要先断开客户端 VPN（Client VPN）。随后在 AWS 控制台修改端点，启用 Split Tunnel，再重新连接客户端。
English
Because the current full-tunnel connection blocks internet access, the client disconnects first. The endpoint is then modified in the AWS console to enable split tunnel, after which the client reconnects.
Transcript
00:26 So now in this exercise, let's set up this split tunnel mode.
00:31 And for doing this, I need to go to AWS console.
00:33 But as of now, I can't access the internet, so I can't access AWS console.
00:36 So the first thing that I need to do is to basically disconnect the client VPN connection.
00:43 And later I will reconnect to that.
00:45 Alright, so let's just disconnect.
00:49 And then I should be able to access the console, right?
3. 在 Endpoint 上启用 Split Tunnel
时间范围：00:56–01:24
总结 / Summary
中文
在客户端 VPN 端点（Client VPN endpoint）的修改页面中，连接协议（connection protocol）区域提供全隧道模式（full-tunnel mode）与分流隧道模式（split-tunnel mode）的选择。勾选 Split Tunnel、保存修改并重新建立 VPN 会话即可应用新路由行为。
English
The endpoint modification page exposes full-tunnel and split-tunnel behavior under connection protocol settings. Enabling split tunnel, saving the change, and reconnecting the VPN session applies the new routing behavior.
Transcript
00:56 And let's go here, let's say action, modify client VPN endpoint.
01:02 And if you just go down here in the connection protocol, you see there is a full tunnel mode
01:07 and the split tunnel mode.
01:09 So let's enable that and modify this.
01:12 Alright, that's it really.
01:14 And we just need to now restart our client VPN connection.
01:19 So let's connect again.
01:21 Okay, it has been connected.
4. 验证私有与公网连接并发现 DNS 故障
时间范围：01:24–01:55
总结 / Summary
中文
重新连接后，私有 EC2 地址与 Google 公共 DNS 地址 8.8.8.8 都能 ping 通，证明 VPC 路径和本地互联网路径均正常；但 google.com 仍无法解析，说明问题位于 DNS 层（DNS layer），而不是网络层（network layer）。
English
After reconnecting, both the private EC2 address and Google's public DNS address 8.8.8.8 respond, proving that the VPC and local internet paths work. A failure to resolve google.com isolates the remaining issue to DNS rather than the network layer.
Transcript
01:24 Alright, so first let's try to connect to our private EC2 instance, which should always work. Right.
01:31 And now let's try to connect to the Google's DNS server.
01:36 And this is also working.
01:37 However, if you see if I'm using the IPv4 protocol and try to ping to google.com, it might not work.
01:45 And the error is not at the network layer, as I said, it is at the DNS layer.
01:49 So it is not able to resolve google.com DNS.
01:52 Now for that, we need to see what's the problem.
5. 诊断 OpenVPN 的 DOMAIN-ROUTE 错误
时间范围：01:55–02:28
总结 / Summary
中文
OpenVPN 日志显示未知的 DOMAIN-ROUTE 选项。AWS Client VPN 会推送 DNS 相关参数，但当前 OpenVPN 客户端无法识别；AWS 提供的客户端可能原生支持这些参数，而本实验需要让 OpenVPN 显式忽略不兼容选项。
English
The OpenVPN logs report an unknown DOMAIN-ROUTE option. AWS Client VPN pushes DNS-related parameters that this OpenVPN client does not understand. An AWS-provided client may support them natively, but this client must explicitly ignore the incompatible option.
Transcript
01:55 And for that, let's go to here and view the logs.
02:00 So let's just scroll down and see if there are any logs.
02:05 So yeah, you see these logs, the DSCP option set unknown option domain route.
02:10 Now, this is because AWS client VPN is pushing some DNS parameter, which open VPN client
02:16 does not understand.
02:17 And that's where probably if you are using AWS provided client VPN software that might
02:21 understand these parameters.
02:23 But because it doesn't understand these parameters, we need to make sure that it ignores these parameters.
6. 修改并重新导入 OpenVPN 配置
时间范围：02:28–03:10
总结 / Summary
中文
在 OpenVPN 配置文件中加入过滤指令，使客户端忽略 dhcp-option DOMAIN-ROUTE。保存文件后断开连接，重新导入更新后的 .ovpn 配置，再重连 VPN；是否需要此修复取决于所用客户端软件。
English
A pull-filter directive is added to the OpenVPN profile so the client ignores dhcp-option DOMAIN-ROUTE. The connection is disconnected, the updated .ovpn profile is re-imported, and the VPN reconnects. This workaround depends on the client software.
Transcript
02:28 So for that, we just need to go back to the VPN client file and add this additional entry
02:35 which says ignore this domain route parameter, right.
02:39 So depending on your client VPN software, you may not have to do this.
02:43 But because I'm using open VPN, I have to do this at this moment.
02:47 All right, let's save it and I need to just re import the same.
02:51 So let me just disconnect.
02:54 And let me re import this updated file.
03:01 And now let me reconnect.
03:05 Alright, so I connected again.
7. 验证 Split Tunnel 与 DNS 修复
时间范围：03:10–03:52
总结 / Summary
中文
修复后依次验证私有 EC2、8.8.8.8 和 google.com，三者均可达，DNS 解析（DNS resolution）也恢复正常。此时 VPC 流量通过 AWS Client VPN，互联网流量则通过本地路由器，符合分流隧道（split tunnel）的预期。
English
After the fix, tests to the private EC2 instance, 8.8.8.8, and google.com all succeed, including DNS resolution. VPC traffic now traverses AWS Client VPN while internet traffic uses the local router, which is the expected split-tunnel behavior.
Transcript
03:10 Now first thing let's ping to the EC2 instance. It is working.
03:15 Then let's ping to Google's 8.8. It is working.
03:19 And now the important test is about ping-4 that is ipv4 protocol google.com and you see it is working.
03:32 So we are now able to resolve the DNS as well.
03:35 So depending on the client VPN, you might have to do these additional settings.
03:39 But now you see the internet traffic is going through my local Wi-Fi router and all the
03:44 VPC traffic is going through the AWS client VPN.
03:48 Right, so I hope you get that.
8. Full Tunnel 通过 VPC Internet Gateway 出网
时间范围：03:52–04:43
总结 / Summary
中文
另一种方案是保留全隧道模式（full-tunnel mode），让全部流量经 VPC 出网。为此需要给 VPC 附加互联网网关（Internet Gateway, IGW），更新目标子网路由表（target subnet route table），并在 Client VPN 的端点路由和授权规则（authorization rule）中加入互联网目标。
English
An alternative is to keep full-tunnel mode and send all traffic through the VPC. This requires an Internet Gateway, updates to the target-subnet route table, and matching internet destinations in the Client VPN endpoint routes and authorization rules.
Transcript
03:52 Alright, so you saw how to access the internet by using the split tunnel functionality.
03:57 Now other option is to also route the internet traffic directly through the VPC.
04:03 Now for that you need to add the internet gateway to your VPC and then you need to add
04:08 the route in the AWS client VPN to allow that traffic to the internet.
04:13 And same thing you need to do for your authorization rule as well.
04:16 So if you do that, then you can access the internet via the VPC.
04:22 So all the traffic again goes through the AWS client VPN endpoint.
04:26 If you configure that in a full tunnel mode and internet traffic will go out through this
04:30 internet gateway.
04:32 Now we are not doing this exercise, but if you want, you can continue to change your
04:36 setup accordingly and see if you can access the internet via this route.
9. 访问 Peered VPC 与 Client VPN 要点回顾
时间范围：04:43–06:21
总结 / Summary
中文
若目标 VPC 已与另一 VPC 建立对等连接（VPC peering），客户端 VPN 也可访问远程 VPC：需要在目标子网路由表中加入对等 VPC 路由，在远程 VPC 中配置返回客户端 CIDR 的路由与允许规则，并在 Client VPN 端点添加对应路由和授权规则（authorization rule）。整体访问控制仍由认证、路由和授权三层共同完成，使用 Active Directory（AD）时还可按用户组授权不同目标网段。
English
A Client VPN can reach a peered VPC when the target-subnet route table routes to that peer, the remote VPC has a return path to the client CIDR and appropriate security controls, and the endpoint contains matching routes and authorization rules. Authentication, routing, and authorization work together, with Active Directory groups enabling per-network user access.
Transcript
04:43 Alright, now one more thing, as I said, you can also access the remote networks through
04:49 this client VPN.
04:51 Now what do I mean by that?
04:52 If you have another VPC, which is paired to this VPC, then again, what you need to just
04:57 do is add another route in the AWS client VPN endpoint and in the authorization rules.
05:03 Now what do I mean by that?
05:05 So just go to the client VPN configuration and here in the authorization rule, add the
05:10 target network as that particular VPC, which is paired and also add corresponding route
05:17 entry in the route table.
05:19 Once you do that, you can also access that paired VPC.
05:23 Alright, so that's everything about AWS client VPN that you should know.
05:28 So just to recap, we saw that there are different components in the client VPN and the important
05:32 ones are the authentication system where you could use active directory or SAML based
05:37 authentication or the certificate based authentication.
05:41 Now further for controlling the access to the target network, you can configure the
05:45 routes in the AWS client VPN as well as you can write authorization rules.
05:50 Now these rules make more sense when you are using the active directory because then you
05:54 can map particular groups of the user to the particular target network.
06:00 And further, we saw a couple of options to access the internet.
06:03 For example, you can use split tunnel mode or you can also use internet gateway of the
06:08 VPC to configure your outbound internet traffic.
06:12 So likewise, we saw that you can access remote networks as well through this AWS client VPN endpoint.
06:19 So that's it about this exercise.
10. 先解除 Target Network 关联
时间范围：06:21–06:39
总结 / Summary
中文
Client VPN 端点和连接会产生持续费用，因此实验结束后必须清理资源。第一步先解除目标网络关联（target network association）；该异步操作需要时间，且完成前不能删除端点。
English
Client VPN endpoints and connections incur ongoing charges, so the lab resources must be cleaned up. The first step is to disassociate the target network. This asynchronous operation takes time and must finish before the endpoint can be deleted.
Transcript
06:21 And before I let you go, make sure that you delete everything because there will be cost
06:25 for per AWS client VPN endpoint and the connections that you made.
06:31 So the first thing that you should do, you should go to the client VPN and disassociate
06:36 this target network because it takes some time.
11. 删除 Client VPN Endpoint
时间范围：06:39–06:48
总结 / Summary
中文
目标网络解除关联后，删除客户端 VPN 端点（Client VPN endpoint）。这会停止端点本身及其连接相关的计费，并移除实验的远程接入入口。
English
After the target network is disassociated, the Client VPN endpoint is deleted. This removes the remote-access entry point and stops endpoint- and connection-related billing.
Transcript
06:39 And once it is done, then you should delete this client VPN endpoint.
06:44 So let's delete that.
12. 终止测试 EC2 Instance
时间范围：06:48–06:53
总结 / Summary
中文
随后终止用于连通性测试的 EC2 实例（EC2 instance）。应等待实例进入已终止状态，再继续删除仍引用该实例网络接口的 VPC 资源。
English
The private EC2 instance used for connectivity testing is then terminated. Waiting for termination to complete avoids VPC deletion failures caused by network resources that are still attached to the instance.
Transcript
06:48 And once you do that, you should terminate the EC2 instance.
13. 删除实验 VPC 与剩余资源
时间范围：06:53–07:18
总结 / Summary
中文
最后删除实验 VPC。VPC 删除流程会一并清理其中的子网（subnet）、路由表（route table）等依赖资源；若控制台暂时拒绝删除，通常表示 EC2 终止或其他依赖资源的释放尚未完成，应等待后重试。
English
Finally, the demo VPC is deleted, which also removes dependent resources such as its subnets and route tables. If deletion is temporarily blocked, an EC2 termination or another dependency has not finished releasing and the operation should be retried after it completes.
Transcript
06:53 And finally, once the instance is terminated, then you should delete your VPC, which will
06:59 internally delete all your subnets, root table, everything, right?
07:03 So as of now, it won't allow me to delete, but I hope you get it right.
07:08 So I will delete it after my EC2 is terminated.
07:11 Alright, so that's it about this exercise, and I hope you enjoyed it. Thank you.
整讲总结 / Overall Summary
中文
本讲完成了 AWS Client VPN 的分流隧道（split tunnel）配置与故障排查：私有 VPC 流量走 VPN、本地互联网流量走本地出口，并通过 OpenVPN 过滤规则修复 DNS 参数兼容性。课程还比较了经 VPC 互联网网关（Internet Gateway, IGW）的全隧道出网方案，说明如何扩展到对等 VPC（peered VPC），最后按依赖顺序清理全部计费资源。
English
This lecture configures and troubleshoots AWS Client VPN split tunneling so private VPC traffic uses the VPN while internet traffic uses the local gateway, including an OpenVPN compatibility fix for DNS parameters. It also explains full-tunnel internet egress through a VPC Internet Gateway, access to peered VPCs, and orderly cleanup of all billable lab resources.
返回顶部 ↑