Hear you.
And welcome back.
Now, in today's video, we'll be discussing about the client VPN connectivity architectures.
Now, the first architecture is very straightforward, where you go ahead and associate a client VPN
with your VPC subnet and the clients that are connected to the client VPN endpoint will only be able
to connect to the resources that are part of the VPC.
The second architecture is associated with a PID VPC where you have a VPC peering in place and the client
through the client VPN endpoint can connect to the resources that are part of the VPC.
So this is also something that can be achieved.
The third possible architecture is where you have a side to side VPN connection.
So you have an on premise network.
So client from the client VPN endpoint can connect to the on premise network via the side to side VPN
connection.
Again, there are multiple possible architectures that can be achieved with the help of client VPN endpoint
and we are just looking into it at a very high level overview.
Now the fourth possible architecture is the access to the Internet, where the client, through the
client VPN endpoint can connect to the Internet via the Internet gateway that is associated with a specific
subnet.
Now the fifth possible architecture is client to client access.
This is an interesting one where both the clients, when they're connected to the client VPN endpoint,
can also perform an inter communication between each other.
So this configuration is also supported at the client VPN endpoint level.
And the last important thing is you can restrict the access using the security group.
So what really happens here is that the client VPN endpoint is associated with a specific security group.
Now let's assume that there are two easy two instances that are running.
What you can do is you can specify within the first AC two instance.
So in the EC two instance A, you can specify that the security group associated with the client VPN
endpoint is allowed.
However, for the EC two instance B, you can specify the security group associated with the client
VPN endpoint is not allowed.
So this is also something that can be done.
Now let me quickly show you this.
Now within the client VPN endpoint that we have, if you look into the security group, this is associated
with a specific security group.
So this is the security group ID.
Let's copy this up under the security groups.
Let me paste this security group and you have the default security group that is associated with the
client VPN endpoint.
Now, this default security group, if you look into the rules over here, there are two rules.
First one is that it is allowing the traffic from the same security group, which is the default one.
And second is it is allowing the traffic from the HTTP port.
Now from the AC to console, I have an easy to instance running and it is also associated with a specific
security group.
Let's open this up.
Now, if we look into the inbound rules over here now within the security group, you see that we have
a rule of one 7230 100 16.
Let's go ahead and delete this rule.
I'll do a save and let's do one thing.
Let's connect to our client VPN endpoint and see if the endpoint is able to connect to the instance.
So let's open up our open VPN connect client.
I'll enable it.
Perfect.
So the connection has been established.
So now let's do one thing.
Let's go ahead and copy the private IP and let's try to ping the private IP here.
By default, the ping will not really work.
It will be a request timeout.
So what you can do within the security group of the instance, let's open this up, let's edit the inbound
rule and you can add a rule, let's say all traffic from a specific security group.
In this case it is the default security group.
So in this case, allow all the traffic from VPN.
You can also write a description, let's say VPN connectivity allowed.
You can see this rule.
Let's try to ping again and you see it is working perfectly well.
Great.
So in today's video we were looking at a high level overview about the various architecture types that
are possible using the client VPN endpoint.
Again, we did not really discuss about the exact implementation step associated with each of the architecture,
but we should know that a specific type of architecture is possible using the client VPN endpoint.
And that was the aim of today's video.
So with this will conclude today's video.