Official mobile apps

AWS Client VPN,
in your pocket.

Connect to your organisation’s AWS Client VPN from iPhone, iPad, or Android. Import your profile, sign in with SSO, and get on with your work.

● iPhone & iPad  ·  Android  ·  Linux  ·  macOS
Download on theApp StoreFor iPhone & iPad Get it onGoogle PlayFor Android

Looking for Linux, macOS, or CI/CD? Explore all platforms

Simple by design

From profile to protected connection.

  1. Download the app

    Choose the app for your phone or tablet.

  2. Import your .ovpn profile

    Use the file your organisation already provides.

  3. Sign in and connect

    Authenticate with your organisation’s SSO in the browser.

What is openlawsvpn?

The official AWS Client VPN desktop client supports Ubuntu Desktop, but does not provide a command-line client or desktop packages for Fedora and other Linux distributions. openlawsvpn fills that gap with a pure-Go implementation of the AWS Client VPN protocol, including the full CRV1 SAML challenge-response flow. It works with any SAML 2.0 identity provider AWS supports — Okta, Microsoft Entra ID, Google Workspace, JumpCloud, and others.

The statically linked CLI runs on Linux and macOS across amd64, arm64, and ppc64le where supported; the GTK4 desktop app ships as a Fedora COPR RPM. No Electron, Mono, JVM, or runtime dependencies. The mobile apps provide the same AWS Client VPN and SAML/SSO workflow on iPhone, iPad, and Android.

Everywhere you work

One client. Your devices.

View install options

iPhone & iPad

Import a profile, complete SAML/SSO, and connect from iOS or iPadOS.

App Store

Android

Use your existing profile and authenticate through a secure browser tab.

Google Play

Linux client

Static CLI binary and GTK4 GUI. Fedora COPR RPM. amd64, arm64, ppc64le.

macOS client

Static CLI binary for Apple Silicon and Intel. No installer needed.

Relay service

Headless VPN auth for CI/CD runners and servers. Human approves SAML from phone. Public demo — no account required.

AWS Client VPN features

🔑

SAML / SSO authentication

Connect through AWS Client VPN with Okta, Microsoft Entra ID, Google Workspace, AWS IAM Identity Center, JumpCloud, or another AWS-supported SAML 2.0 provider.

📄

Import your existing profile

Use the .ovpn profile supplied by your organisation. Your VPN endpoint and identity-provider configuration stay under your organisation’s control.

🔒

Privacy-first connection flow

Credentials are entered only on your identity provider’s sign-in page. VPN profiles remain on your device; the apps contain no advertising or analytics SDKs.

⚙️

Mobile, desktop, and CI/CD

Connect interactively from mobile or desktop, or use Relay to approve SAML authentication for headless CI/CD runners without storing SSO passwords in pipelines.

Frequently asked questions

What does openlawsvpn connect to?

openlawsvpn connects to AWS Client VPN endpoints configured for federated SAML authentication. It is not a consumer VPN service and does not provide a VPN endpoint or an identity-provider account.

Which devices are supported?

The client is available for iPhone and iPad on the App Store, Android on Google Play, and as Linux and macOS tooling. See client downloads and installation instructions.

Which SSO providers work?

It works with SAML 2.0 identity providers supported by AWS Client VPN, including Okta, Microsoft Entra ID, Google Workspace, AWS IAM Identity Center, and JumpCloud.

Does openlawsvpn collect my VPN credentials or traffic?

No. Sign-in happens with your identity provider, and VPN traffic goes directly to the AWS Client VPN endpoint selected in your profile. Read the Privacy Policy for details.

SAML / SSO support

openlawsvpn implements the complete CRV1 challenge-response flow required by AWS Client VPN. It works with any SAML 2.0 IdP supported by AWS — no custom configuration beyond what you already have set up.

🔐

Interactive (desktop / mobile)

SAML login page opens in your system browser or Chrome Custom Tab. Credentials never touch openlawsvpn code.

🤖

Headless (CI/CD, servers)

Use Relay — a human approves auth from their phone while the headless agent establishes the tunnel. No secrets in the pipeline.

Quick start

For full install options including Fedora COPR RPM, GTK4 GUI, macOS, and Android — see the Client install page.

BASE=https://github.com/openlawsvpn/go-openlawsvpn/releases/latest/download
curl -LO $BASE/openlawsvpn-cli-linux-amd64
chmod +x openlawsvpn-cli-linux-amd64
sudo mv openlawsvpn-cli-linux-amd64 /usr/local/bin/openlawsvpn-cli
sudo openlawsvpn-cli --config ~/Downloads/client-config.ovpn