AWS VPN

Site-to-Site VPN connects supported networks through encrypted tunnels; Client VPN connects individual clients. Start with hybrid topology, routes and workforce identity.

Site-to-Site

A customer gateway resource represents the supported customer endpoint; the AWS termination can use a VGW or TGW design. Configure both tunnels and verify actual failover. Static and dynamic BGP routing are supported with different operational implications.

BGP/ECMP, tunnel bandwidth, acceleration and endpoint address options are mode-specific. Do not universalize one bandwidth/default ASN/IPv4 requirement to all VPN variants. A quota increase is not a throughput guarantee.

Client VPN

Authentication options include Active Directory, mutual certificates and SAML federation. OIDC is not a documented direct Client VPN authentication option; Active Directory is not the same mechanism as SAML federation.

Target-network associations, endpoint routes, authorization rules and SGs are separate. Authentication success alone does not authorize every destination. Split/full tunnel decisions affect routing, DNS and egress.

Sandbox access drill

Prerequisites: approved test VPN endpoint and a nonsensitive private server, scoped administration and an independent management path. Tunnel/endpoint/connection charges may apply.

1. Record client/source identity, authorized destination and expected route.
2. Connect and test only the allowed service.
3. Attempt an excluded destination; expect failure despite successful authentication.
4. For Site-to-Site, test an approved single-tunnel failure and observe route/client recovery.
5. Restore the original configuration; verify both tunnels/routes or intended client associations.
6. Remove dedicated endpoints/connections/associations, customer-gateway resources and logs only after confirming no shared dependency.

Collect client/server logs, route tables and connection status; distinguish credentials, certificate validity, DNS, routes and SG failures. Measure failover rather than quoting a fixed application recovery time.

Routing and access comparison

Question	Site-to-Site VPN	Client VPN
Who connects?	Customer network gateway to AWS gateway	Individual client to endpoint
Routing	Static or BGP with tunnel routes	Endpoint route table plus target network association
Access boundary	Prefixes, SGs/NACLs and customer firewall	Authentication, authorization rules, routes and SGs
Resilience test	Both tunnels and customer/AWS route convergence	Endpoint association, client reconnect and DNS behavior

on-prem router → tunnel A/B → VGW or TGW → VPC subnet → private service
user device → Client VPN endpoint → target association → authorized route → service

For BGP Site-to-Site VPN, record advertised/accepted prefixes and route priority; for static routing, maintain the explicit prefixes on both ends. In both cases, confirm return routing and MTU-sensitive application behavior. For Client VPN, a successful authentication result only establishes identity; the destination also needs an authorization rule, endpoint route, associated target network and matching SG. Split-tunnel clients may retain local routes that affect which resolver or path handles a request.

References

• Site-to-Site routing types.
• Site-to-Site introduction.
• Client VPN authentication.
• Client authorization.
• Pricing.

Across the wiki

• GCP Cloud Interconnect & HA VPN — hybrid connectivity (GCP)
• EKS Hybrid Nodes — hybrid connectivity (Kubernetes)