Connect to an AWS Client VPN endpoint using an AWS provided client

You can connect to a Client VPN endpoint using the AWS provided client, which is supported on Windows, macOS, and Ubuntu. You can use the client in two ways — through the graphical user interface (GUI) or the command line interface (CLI). The AWS provided client also supports up to five concurrent connections as well as OpenVPN directives.

Topics

Security

Security is the highest priority in the AWS provided client. We regularly release patches to improve the security posture of the application. The AWS provided client includes several unique security features compared to other OpenVPN clients, including SAML authentication, Client Routes Enforcement, and device settings monitoring.

While the AWS provided client is designed to mitigate threats originating from misconfigured or compromised network environment, it is not responsible for modifying the environment or eliminating the external threats at their source. The AWS provided client relies on the customers to maintain a secure and well-configured environment. This includes:

Software updates

We recommend that you always run the latest version of the AWS provided client to receive the newest features and security patches.

On Windows and macOS, the AWS provided client automatically checks for a newer version and, when one is available, displays a notification that prompts you to update. Follow the prompt to install the update.

On Ubuntu, the AWS provided client for Linux does not automatically check for updates. We recommend that you install the client through the package repository and keep it current from there. For more information, see Install the provided AWS Client VPN for Linux.

Connect using the command line interface

The AWS Client VPN Command Line Interface (CLI) provides a lightweight, scriptable interface to manage VPN profiles and connections. The CLI is available on Windows, macOS, and Linux, and enables enterprise administrators to automate VPN deployments, manage profiles at scale, and integrate Client VPN with existing management infrastructure.

The CLI tool is named aws-vpn-client and is installed alongside the AWS provided client from version 6.0 onwards.

The CLI provides access to all features of the client application, including profile management, connection management, and administrative configuration.

For details on CLI commands and syntax, see CLI command syntax.

Administrative controls

AWS Client VPN administrative controls provide global configuration settings and profile management capabilities that enable administrators to manage VPN client deployments at scale.

With administrative controls, administrators can:

To run administrative commands, you need elevated privileges (sudo on macOS/Linux, administrator on Windows).

You can use the following preference settings with aws-vpn-client put-preference:

In addition, you can import profiles globally for all users on a device by using aws-vpn-client import-profile with the --global flag and elevated privileges.

For the full list of CLI commands and syntax, see CLI command syntax.

Support for concurrent connections using an AWS provided client

The AWS provided client supports connecting to multiple concurrent sessions. This is helpful if you need access to resources across multiple AWS environments and have different endpoints for those resources. For example, you might need access to a database in an environment at an endpoint that's different from the endpoint you're currently connected to, but you don't want to disconnect the current connection. To enable your AWS provided client to connect to multiple sessions, download the configuration file that your administrator created for each endpoint, and then create a connection profile for each file. Using the AWS provided client, you can then connect to multiple sessions without disconnecting from any session currently open. This is supported for AWS provided clients only. For the steps to connect to concurrent sessions, see Connect using the AWS provided client.

When connecting to multiple endpoints, Client VPN checks for conflicts with other open endpoint connections — for example, if two sessions have conflicting CIDR blocks or routing policies, or if you're already connected with a full tunnel connection. If the check finds conflicts, the connection fails. You must either choose a different connection that doesn't conflict with the open connection, or disconnect from the open session that's causing the conflict.

Concurrent DNS connections are allowed. The DNS server of one of the DNS-enabled connections is applied. Depending on the DNS server, you might be prompted for authentication during that reconnection.

Connecting to an endpoint that requires device posture

If your administrator has enabled device posture on an endpoint, the AWS provided client collects device posture data from your device trust provider when you connect and sends it to the endpoint for evaluation. To connect to an endpoint that requires device posture, you must meet the following requirements:

If your device does not meet the policy, the connection is refused. Your session can also end mid-session if your device later falls out of compliance. If you are denied unexpectedly, confirm your device trust provider is set up and your device is compliant with your organization's requirements, then try again.

OpenVPN directives

The AWS provided client supports the following OpenVPN directives. For more information about these directives, see the documentation at the OpenVPN website.