Client VPN not associating for hours

Question

Hi, I've setup a client VPN endpoint and it's saying "pending associate" for hours.  I've deleted it and recreated one with the bare minimum options, and it's doing the same.

The only thing I can think of is the server cert from easy-rsa is causing problems, but I have no way of knowing. 
I am using my own CA in easy-rsa on linux, and am using just the server cert for both the server and client certificates in the vpn setup.

FYI I created the server cert using one of the guides out there, and using this command: ./easyrsa --nopass build-server-full my-vpn
and after importing to ACM, it uses "my-vpn" in the domain field.  This should just be a CN that I'm specifying on the command and not matter, but someone with more knowledge might know better..

Other questions that might be pertinent:
- the client endpoint range does not exist/overlap with my target VPC. 
- do I associate the public or private subnets to the endpoint?  My goal is to allow access to resources in private subnets, but I see in the docs the subnets you associate must have route to the internet gateway.. but it's unclear to me if it can be through the NAT gateway.
-When I associated public subnets, and look at the route table, it's showing "NAT"  as the type.  Should it be "routed" or is this normal?

re:Post Agent · Accepted Answer

Based on the information provided, there are several potential issues that could be causing your Client VPN endpoint to remain in a "pending associate" state for an extended period. Let's address your concerns and provide some guidance:

1. Server Certificate: While the server certificate could potentially cause issues, it's unlikely to be the sole reason for the "pending associate" state. However, it's important to ensure that the certificate is valid and properly imported into AWS Certificate Manager (ACM).

2. Certificate Creation: The command you used to create the server certificate (./easyrsa --nopass build-server-full my-vpn) is correct. The "my-vpn" in the domain field is indeed the Common Name (CN) you specified, and this should not cause issues with the VPN setup.

3. Client Endpoint Range: It's correct that the client endpoint range should not overlap with your target VPC. This is not likely to be the cause of the "pending associate" state.

4. Subnet Association: For your goal of allowing access to resources in private subnets, you should associate the private subnets with the Client VPN endpoint. The subnets you associate must have a route to the internet gateway, which can be through a NAT gateway for private subnets. This allows the VPN clients to access the internet and AWS services.

5. Route Table: The "NAT" type shown in the route table for associated public subnets is normal. This indicates that the traffic is being routed through a NAT gateway, which is expected for internet access from private subnets.

To troubleshoot the "pending associate" state:

1. Check the status of your server certificate in the AWS Certificate Manager console or using the AWS CLI. Ensure it hasn't expired.

2. Verify that the firewall rules for the Client VPN endpoint are not blocking TCP or UDP traffic on ports 443 or 1194.

3. Confirm that the configuration file contains the correct client key and certificate.

4. Ensure that the Client Certificate Revocation List (CRL) is still valid if you're using one.

5. Review the VPC and subnet configurations to ensure they are correctly set up and have the necessary routes.

6. Check AWS CloudTrail logs or VPC Flow Logs for any error messages or issues related to the Client VPN endpoint.

If the issue persists after verifying these points, you may need to contact AWS support for further assistance, as there could be an underlying issue with the AWS infrastructure or your account configuration.

**Sources**  
[Troubleshooting AWS Client VPN: Client software returns a TLS error when trying to connect to Client VPN - AWS Client VPN](https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/client-cannot-connect.html)  
[Troubleshooting common AWS Client VPN problems - AWS Client VPN](https://docs.aws.amazon.com/vpn/latest/clientvpn-user/common-troubleshooting.html)  
[disassociate-client-vpn-target-network — AWS CLI 2.18.6 Command Reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/disassociate-client-vpn-target-network.html)  
[Troubleshooting AWS Client VPN connections with macOS clients - AWS Client VPN](https://docs.aws.amazon.com/vpn/latest/clientvpn-user/macos-troubleshooting.html)

Gary Mclean · Answer

As per the AI, you need to complete all the steps before its complete..

Private subnets is fine as its a CLIENT VPN Service you do not connect over the internet to your VPC, but to the VPN Client endpoint via Network interfaces into your VPC.

Client VPN not associating for hours

Add your answer

Relevant content