AWS vpn documentation change
Summary
Updated documentation to reflect IPv6 and dual-stack support for AWS Client VPN, including changes to NAT behavior, subnet requirements, DNS handling for full-tunnel endpoints, and restrictions on client-to-client IPv6 communication.
Security assessment
The changes clarify security-related behaviors such as IPv6 client-to-client traffic being dropped (a security control) and DNS traffic being forced through the tunnel to prevent leaks. These updates document security features rather than addressing a specific vulnerability.
Diff
diff --git a/vpn/latest/clientvpn-admin/what-is-best-practices.md b/vpn/latest/clientvpn-admin/what-is-best-practices.md index cbe9e68c3..ac2e18462 100644 --- a//vpn/latest/clientvpn-admin/what-is-best-practices.md +++ b//vpn/latest/clientvpn-admin/what-is-best-practices.md @@ -38 +38 @@ The following sections describe the rules and best practices for using AWS Clien - * Client VPN supports IPv4 traffic only. See [IPv6 considerations for AWS Client VPN](./ipv6-considerations.html) for details regarding IPv6. + * Client VPN supports IPv4, IPv6, and dual-stack (both IPv4 and IPv6) traffic. For more details on IPv6 support, see [IPv6 considerations for AWS Client VPN](./ipv6-considerations.html). @@ -40,3 +40 @@ The following sections describe the rules and best practices for using AWS Clien - * Client VPN performs Network Address Translation (NAT). When a client connects through Client VPN: - - * The source IP address is translated to the Client VPN endpoint's IP address. + * * The source IP address is translated to the Client VPN endpoint's IP address. @@ -59,0 +58,2 @@ For example, when two clients, client 1 and client 2, connect to the same destin + * For IPv6 traffic, Client VPN does not perform Network Address Translation (NAT). This provides enhanced visibility into the connected user's IPv6 address. + @@ -70,0 +71,4 @@ For example, when two clients, client 1 and client 2, connect to the same destin + * For IPv6 or dual-stack traffic, the associated subnets must have IPv6 or dual-stack CIDR ranges. + + * For dual-stack endpoints, you cannot associate more than one subnet per Availability Zone. + @@ -98,0 +103,2 @@ For example, when two clients, client 1 and client 2, connect to the same destin + * In Windows, when a full-tunnel endpoint is used, all DNS traffic is forced through the tunnel, regardless of the endpoint's IP address type (IPv4 IPv6, or dual stack). For DNS to function, a DNS server must be set up and reachable within the tunnel. + @@ -109,0 +116,4 @@ For example, when two clients, client 1 and client 2, connect to the same destin + * Client-to-client communication is not supported for IPv6 clients. If an IPv6 client tries to communicate with another IPv6 client, the traffic will be dropped. + + * IPv6 and dual-stack endpoints require that user devices and internet service providers (ISPs) support the corresponding IP configuration. +