---
title: 'Tutorial: Connect VPN Clients to Another EC2 Instance in AWS When Access Server Uses Route Mode'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--connect-vpn-clients-to-another-aws-ec2/
product: Access Server Docs
description: Learn how to enable communication between VPN clients and another EC2 instance in the same AWS VPC when Access Server runs in Route mode, using a static route and source/destination check configuration.
---

# Tutorial: Connect VPN Clients to Another EC2 Instance in AWS When Access Server Uses Route Mode

## Overview

When Access Server operates in **Route** mode, VPN clients receive IP addresses outside the AWS VPC subnet. As a result, EC2 instances in the VPC don't have a return route to the VPN client subnet by default, so communication fails until you add a static route.

This tutorial shows how to configure AWS route tables and Access Server so VPN clients can communicate with another EC2 instance in the same VPC.

> **Note**
>
> In our documentation, we use example IPv4 addresses and subnets [reserved for documentation](https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4), such as `192.0.2.0/24`, `198.51.100.0/24`, and `203.0.113.0/24`.
>
> Ensure you replace them with valid IPv4 addresses and subnets for your network(s).

## Prerequisites

- Access Server deployed.
- Admin Web UI access.
- One or more users or groups configured in Access Server.

Ensure the following AWS resources are available:

- A VPC containing the Access Server and the target EC2 instance.
- A subnet for the Access Server EC2 instance.
- A subnet for the target EC2 instance.
- A route table associated with the Access Server subnet.
- A route table associated with the target EC2 instance's subnet.

Example environment:

| **EC2 Instance** | **VPC** | **Subnets** | **Private IPs** |
| --- | --- | --- | --- |
| Access Server | my-staging-vpc | 192.0.2.0/25 | 192.0.2.5 |
| Ubuntu | my-staging-vpc | 192.0.2.128/25 | 192.0.2.135 |

| **VPN client subnet** | **Configured in** |
| --- | --- |
| 198.51.100.0/24 | Access Server's Global Access Rules (Network Settings) |

## Step 1: Configure the route table for the Ubuntu EC2 instance

1. Sign in to the AWS Management Console.
2. Navigate to **VPC**.
3. Under **Virtual private cloud**, select **Route tables**.
4. Select the route table associated with the Ubuntu EC2 instance.
5. Under **Routes**, select **Edit routes**.
6. Select **Add route**.
7. Configure the route:
   - **Destination:** `198.51.100.0/24`
   - **Target:** Select the Access Server EC2 instance.
8. Select **Save changes**.

## Step 2: Disable source/destination checks on the Access Server instance

1. Navigate to your Access Server EC2 instance.
2. Select **Actions → Networking → Change source/destination check**.
3. Select the **Stop** checkbox under **Source / destination checking**.
4. Select **Save** to disable the check.

   > **Tip**
   >
   > AWS source/destination checks prevent an EC2 instance from forwarding traffic that isn't addressed to itself. Disabling this check allows Access Server to route VPN traffic between clients and the VPC.

   > **Note**
   >
   > If your Access Server EC2 instance has multiple network interfaces, you must disable the source/destination check separately on each interface that handles VPN traffic. Refer to [Disable source/destination checks in AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/work-with-nat-instances.html#EIP_Disable_SrcDestCheck).

## Step 3: Configure routing in Access Server

1. Sign in to the Admin Web UI.
2. Select **Access Controls**.
3. Select the **Global Access Rules** tab.
4. Verify the routing mode is **Route**.
5. Add the Ubuntu subnet (`192.0.2.128/25`) to **Subnets**.
6. Select **Save** and **Restart**.

## Step 4: Verify connectivity

1. Connect to the VPN.
2. Ping the Ubuntu EC2 instance:

   ```
   ping 192.0.2.135
   ```

   - Expected result example from a Windows client:

     ```
     Pinging 192.0.2.135 with 32 bytes of data:
     Reply from 192.0.2.135: bytes=32 time=30ms TTL=63
     Reply from 192.0.2.135: bytes=32 time=30ms TTL=63
     Reply from 192.0.2.135: bytes=32 time=29ms TTL=63
     Reply from 192.0.2.135: bytes=32 time=30ms TTL=63
     Reply from 192.0.2.135: bytes=32 time=31ms TTL=63
     Ping statistics for 192.0.2.135:
         Packets: Sent = 5, Received = 5, Lost = 0 (0% loss)
     ```

---

Prev: [Tutorial: Communicate Between Two VPCs in AWS Using a Single Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--connect-two-aws-vpcs-with-a-vpc-peering-connection.md)
Next: [Tutorial: Using AWS Transit Gateway with Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--aws-transit-gateway.md)
Index: https://openvpn.net/as-docs/llms.txt