Client VPN

This page explains the optional Client VPN, which connects your team's devices securely to private services in your environments, how to request it, and what to do when it will not connect or your VPN certificate has expired.

The Client VPN is opt-in. It is not installed by default, and you do not need it if your organisation already runs its own VPN — most teams do. It is there for teams that want a simple managed option.

What it is

The Client VPN is built on NetBird. Once it is set up, a team member's laptop can reach private services in your environments — services that are deliberately not exposed to the internet — without opening them up publicly.

Direct, encrypted connections. Traffic goes over an encrypted WireGuard tunnel straight between the device and the service it reaches, and is only relayed when a direct connection is not possible.
Access to specific resources, not whole networks. Access is granted to the services a person needs, rather than to an entire network.
Your network rules still apply. Cloud firewall rules and security groups still decide what can be reached; the VPN does not bypass them.

Who does what

	Who
Deciding to use it, and who should have access to what	Your team
Installation and initial setup	CTO2B
Connecting to your environments	CTO2B

Requesting it

Raise a request asking for the Client VPN. Include:

which environments and services people need to reach
roughly how many people will use it
whether you already run a VPN, so we can check the two will not overlap

CTO2B installs and configures it, connects it to your environments, and helps your team get connected.

What it does not replace

Access requests still apply. Direct access to Kubernetes namespaces, databases and the AWS Console goes through Access Requests and Teleport, with or without the Client VPN.

Troubleshooting: the VPN will not connect

Use this section if the VPN is down, will not connect, connects but cannot reach anything, or you think your VPN certificate or profile has expired. It covers VPN connections from individual devices only. For a tunnel between whole networks, see Site-to-Site VPN and On-Premises Connectivity.

Start by checking which kind of VPN you use:

NetBird client. You sign in through your browser, and there is no certificate file to manage. This is the Client VPN described on this page.
Certificate-based profile. Some environments set up before the Client VPN existed use an OpenVPN profile (an .ovpn file) with a certificate inside it. That certificate has a fixed expiry date.

Check these first

Is it only you? Ask a colleague who uses the same VPN to connect. If nobody can connect, skip ahead and raise a request. If only you are affected, the problem is almost always on your device or with your own profile or login.
Sign in again (NetBird). Your login session can expire. Disconnect, then connect again from the NetBird client and complete the browser sign-in. From a terminal, netbird status shows whether the client is connected and signed in.
Check the expiry date (certificate-based profile). An expired certificate cannot be renewed on your side; you need a new profile. Your VPN client usually reports a TLS or certificate error when this happens. To read the expiry date yourself, copy the certificate block from the .ovpn file into a file and run:
```
openssl x509 -noout -enddate -in client-cert.pem
```
Make sure you are using the newest profile. If you were sent a replacement, remove the old profile from your VPN client, then import the new one. An old profile left in place is easy to pick by mistake.
Update the VPN client. An out-of-date client can fail to connect after a server-side upgrade.
Rule out a clash with another VPN. Disconnect any other VPN, including a corporate VPN, and try again. Two VPNs that route the same address ranges break each other.

Connected, but services cannot be reached

Names do not resolve. Try the service by IP address. If the IP address works and the name does not, your device is not using the VPN's DNS. Another VPN or a local DNS setting is often the cause. See DNS Resolution Troubleshooting.
Some services work and others do not. The VPN gives access to specific resources, not whole networks, and cloud firewall rules still apply. A service you have never used over the VPN may simply not be in your access. Raise a request naming the service.
Only one Environment is unreachable. Say which Environment in your request, and whether the others still work.

Getting a new certificate or profile

Raise a request in your dedicated Slack channel for a new VPN certificate or profile. Say who needs it and which Environment it is for, for example UAT or production. CTO2B issues the new profile. Once you have it, delete the old one from your device.

To avoid a sudden lockout, note your certificate's expiry date when you receive it, and ask for a replacement a few days before it expires.

Still having issues?

Raise a request in your dedicated Slack channel with:

the Environment you are trying to reach
which VPN you use (NetBird client or a certificate-based profile), and your client version
the exact error message, or a screenshot of it
whether colleagues are affected too, and when it last worked
for a certificate-based profile, the expiry date if you checked it

If nobody on your team can connect and this is blocking a production issue, follow Getting Help to raise it at the right severity.

Access Requests — approved, time-limited access through Teleport
Site-to-Site VPN and On-Premises Connectivity — connect whole networks (office, data centre, partner) rather than devices
Network Policies — which workloads can talk to each other
CTO2B Access to Your Production Environment
Getting Help — how to raise a request and choose a severity