title: Purpose of AWS Client VPN Client CIDR Range?
body: <p>Originally asked <a href="https://forums.aws.amazon.com/thread.jspa?threadID=314173&amp;tstart=0" rel="nofollow noreferrer">on the AWS forums</a> but I get the sense I won't hear back for quite some time, so I'm also posing my questions here:</p>
  
  <p>I recently set up a Client VPN based on <a href="https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/cvpn-getting-started.html" rel="nofollow noreferrer">this guide</a>. When connected I'm successfully able to access the internet as well as resources in a private subnet, so at this point I have a basic understanding of how all the parts fit together, except for one: the Client CIDR range. This concept gave me so much trouble that I think it stretched out the time-to-build by 2 days because of all the thrashing I did trying to connect it to the other concepts Client VPN involves. But it bugs me when I don't fully understand a thing so I have some questions about it:</p>
  
  <ul>
  <li>Does the Range benefit at all from being in the same CIDR range as the VPC it's a part of, assuming it doesn't overlap with target network(s)? Why or why not?</li>
  <li>Why does the Range need to be of size /22, while target networks can be as small as /27? Doesn't that imply 2^5 more clients could be attempting to access a resource in a VPC as there are available addresses in a given subnet?</li>
  <li>In setting up security groups for the private subnet I noticed that I had to use rules based on the CIDR range of the target subnet client connections landed in, rather than the Client CIDR range - why is that?</li>
  </ul>
  
  <p>As you can probably tell from my questions, I'm not a network administrator. I'm trying to understand that world at the same time I'm trying to spin up useful infrastructure. My guess is the answers to these questions are blindingly obvious to someone with experience in that area, but I just don't get it.</p>