--- name: vmwaresolutions-arch-pattern-vcf-clientvpn title: Architecture pattern for deploying Client VPN into VMware Cloud Foundation for VPC description: As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. last-updated: 2025-10-24 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vmwaresolutions?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Architecture pattern for deploying Client VPN into VMware Cloud Foundation for VPC {: #arch-pattern-vcf-clientvpn} As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. {: deprecated} This architecture pattern explains how to deploy Client VPN for VPC (Virtual Private Cloud) with an VMware Cloud Foundation for VPC deployment. Client VPN for VPC provides client-to-site connectivity, which allows remote devices to securely connect to the VPC network by using an OpenVPN software client. This solution is useful for VMware® administrators who want to connect to the IBM Cloud from a remote location to manage an VMware Cloud Foundation for VPC instance. An overview of this architecture pattern is shown in the following diagram. ![Using a client VPN with an VMware Cloud Foundation for VPC deployment](../../images/vcf-arch-clientvpn.svg "Using a client VPN with an VMware Cloud Foundation for VPC deployment."){: caption="Using a client VPN with an VMware Cloud Foundation for VPC deployment" caption-side="bottom"} ## Deploying Client VPN into VCF for VPC {: #arch-pattern-vcf-clientvpn-deploy} The following diagram introduces the high-level steps to deploy Client VPN into VCF for VPC. ![Deploying Client VPN into VCF for VPC](../../images/vcf-arch-clientvpn-steps.svg "Deploying Client VPN into VCF for VPC."){: caption="Deploying Client VPN into VCF for VPC" caption-side="bottom"} This architecture pattern deployment is summarized as follows: 1. Review general [planning considerations for VPN servers](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-vpn-planning&format=markdown). 2. Decide which VPN client authentication mode to use: certificate-based, user ID and passcode, or both. 3. [Create a Secrets Manager service instance](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&format=markdown) and create and upload your TLS certificates. 4. Create an [IAM service-to-service authorization](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-authentication&format=markdown#creating-iam-service-to-service) for your VPN server and IBM Cloud Secrets Manager. 5. Design your Client IPv4 address pool and network access, general routing, and VPN server placement. Use the VCF for VPC and Tier 0 private uplink VPC subnet or management subnet, depending on your networking requirements. 6. Provision a stand-alone VPN server in a subnet (or provision a VPN server in two subnets for better high availability). For more information, see [Creating a VPN server](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-server&format=markdown). 7. [Create VPN routes](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-routes&format=markdown) on your VPN server and [VPC routes](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-route&interface=ui&format=markdown) on the VCF for VPC. 8. [Set up a client VPN environment](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-environment-setup&format=markdown) and connect to the VPN server. ## Tips for deploying Client VPN into VCF for VPC {: #arch-pattern-vcf-clientvpn-deploy-tips} * When you create VPN routes, you can use `translate` option to translate the source IP to the VPN server's private IP address before it is sent out from the VPN server, making your VPN client IP address from Client IPv4 address pool invisible to the destination devices. This process eases VPC up routing configurations. * Split tunnel is typically the mode what you would use if you need simultaneous access to the corporate network and VCF for VPC. Then, private traffic flows through the VPN interface to the VPN tunnel, and public traffic flows through the existing LAN interface. You can manage this process with VPN routes. * The VMware Cloud Foundation instance uses IBM Cloud DNS Server default IP addresses `161.26.0.7` and `161.26.0.8`. When you manage the VMware Cloud Foundation instance, you need to ensure that you can use the DNS server and resolve the VMware Cloud Foundation entries. So ensure that your VPN routes cover this range. ## Considerations {: #arch-pattern-vcf-clientvpn-considerations} When you design or deploy this architecture pattern, consider the following information: * Design your IP addressing and VPN routing patterns. Think about the networks to be routed to the VCF for VPC and what NSX overlay networks you need to access from the VPN. * Review general [planning considerations for VPN servers](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-vpn-planning&format=markdown). * Decide your VPN client authentication mode. You can use certificate-based, user ID and passcode, or both. * It is recommended to create private certificates with [these considerations](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-authentication&format=markdown#using-private-certificate) in mind. ## Related links {: #arch-pattern-vcf-clientvpn-links} * [VPC network design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-vcf-vpc-deployment&format=markdown) * [VPC client-to-site VPN servers](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview&interface=ui&format=markdown)