#Viscosity vpn tutorial full
#Viscosity vpn tutorial download

telnet on mysql port to rds (in VPC B), using private IP.

Ssh -i KEY_FILE It's OK if auth fails b/c you don't have SSH key, this still proves net access is OK

Access to VPC B (Like #2, but this tieme directly from your laptop) using private IP.

Ssh It's OK if auth fails b/c you don't have SSH key, this still proves net access is OK Ssh -i KEY_FILE Access to VPC B (some EC2 instance, or create a 'temp' instance if needed) using private IP from host in VPC A

Access to VPC A (from an EC2 instance- if your VPC does not have an instance create one a 'temp' one w/ public IP and a security group that allows acces from within the VPC).

The specific steps might vary for you, but here are some of the stpes (connections) that I tested for the scenario described above. Things can get tricky for complex set ups, so it's best to test one step at a time. Server: _ Use the '.2' address in the VPN's client cidr block _

Zero or more routes like this: Route for peered VPC's cidr block, gateway = vpn_gateway.

Route for VPN's VPC cidr block, gateway = vpn_gateway, and.

Then edit the config (Viscosity -> Preferences) as follows:

#Viscosity vpn tutorial download

0.0.0.0/0 for All to Internet Gateway (igw-*)Д¬reate a config by importing the client config (ovpn file) that you download from AWS.

Route Table associated with cVPN's associated subnet

If you want DNS to resolve to private IP addresses (necessary in my scenario described above), be sure to enable 'Allow requester VPC (.) to resolve DNS of accepter VPC (.) hosts to private IP' for the Peering Connection.

The accepter VPC must have a return route for cVPN's subnet.

0.0.0.0/0 for All (to authorize access to internet gateway) (? Not sure if this is required?).

For each VPC Peering connection: CIDR block for acccepter side VPC.

? VPNs client cidr block (is this required?).

? Inbound, All traffic from the cVPN's CIDR block (is this required?)ДЄuthorizations (all the cidr blocks that user will want to access via the VPN).

? Inbound, All traffic from the subnet's CIDR block (is this required?).

Inbound, All traffic from same security group (self).

Subnet - subnet's CIDR block must NOT overlap cVPN's client cidr block Peered VPC: Id _ / Name _ / CIDR _ДЄssociations: Atleast 1 association to a subnet and a security group in that subnet

Route table for the subnet that is assocaited to the VPN.

WorksheetДЄfter creating the Endpoint, RDS instances, VPCs, etc, gather the relevant details for reference later. They are labelled with a ? and a question. NOTE 2: There are a few things I wasn't certain are required. Start with AWS's getting started to walk you through the steps of creating the basic endpoint.

#Viscosity vpn tutorial full

NOTE: This is a trouble shooting / set up checklist not full documentation. This checklist can be helpful to troubleshoot or if you have a slightly different scenario from what AWS's tutorial covers, such as the arrangement I describe above. You can read the AWS getting started docs for Client VPN endpoint, but there's a lot of details.

Split routing is important so that only the AWS destined traffic goes over the VPC tunnel and other internet traffic can go direct to internet. Split DNS is important so that Amazon hostnames can be resolved to their internal IP addresses. I choose Viscosity (on a Mac) as our VPN client because it's easy to use and support split-dns and split-routing. I choose the Cliet VPN Endpoint so that AWS would manage the remote side of the tunnel. This is summarized as: laptop -ClientVPN-> VPC _A_ -VPC Peer-> RDS in VPC _B_ The RDS databases are in different VPCs, they have the 'publicly accessible' attribute set, which means they get a pubilc DNS, but only a handful or IPs are whitelisted for that access developers should get access over a VPN. The AWS servers (EC2, fargate) are in a private VPC. We have remote developers who occassionally need access to AWS servers QA and Staging databases (RDS mysql instances).