AWS Client VPN: Intermittent connectivity to destination - works for some users but not others with the same configuration

Based on the information provided, there are two key clues that point to the cause of the issue:

1. A test instance in the VPN VPC can reach the destination successfully. This rules out TGW routing, and the destination-side configuration. The network path from the VPC onwards is working correctly.

2. VPC Flow Logs show no traffic from the affected users. This means the traffic is being dropped before it enters the VPC. If the issue were at the TGW or destination VPC level, you would see traffic leaving the VPN VPC but failing at a later hop. The fact that no traffic appears at all tells us the Client VPN endpoint itself is not forwarding the traffic into the VPC for those users.

The correlation with client IP ranges is the final clue. Client VPN distributes connecting users across the available subnet associations using DNS round-robin. Users assigned IPs in one range are connected to one association, while users in another range are on a different association. If connectivity works for one IP range but not another, it means the associations are behaving differently.

This is a known Client VPN behaviour documented by AWS here. The issue could be that the route for your destination CIDR is not configured on all subnet associations.

Clients connect to a Client VPN endpoint based on the DNS round-robin algorithm. This means their traffic can be routed through any of the associated subnets when they establish a connection. If a route only exists for one or two of the associated subnets but not all of them, users who land on an association without the route will experience connectivity failures. Their traffic is silently dropped at the Client VPN level.

How to diagnose

List all routes and their target subnet associations:

aws ec2 describe-client-vpn-routes --client-vpn-endpoint-id cvpn-endpoint-1234567890123456

Look for your destination CIDR in the output. If it only appears with one or two subnet association targets but not all of them, that is the problem.

How to fix

Add the missing route to all subnet associations via the console (VPC → Client VPN Endpoints → Route Table → Add Route) or via CLI:

aws ec2 create-client-vpn-route --client-vpn-endpoint-id cvpn-endpoint-1234567890123456 --destination-cidr-block 10.x.x.x/x --target-vpc-subnet-id subnet-1234567890123456

Repeat for each subnet association that is missing the route.

References

• Troubleshooting AWS Client VPN: Access to a peered VPC, Amazon S3, or the internet is intermittent
• AWS Client VPN routes