Connectivity to AWS EKS control plane via Client VPN

Question

I have created EKS cluster with API server endpoint access as "Private". Cluster is configured in private su.net. I'd like to allow kubectl access from local PC. I have created Client VPN, it has access to private.network (verified that by SSH to an EC2 instance running in the same private su.net). But kubectl gets "unable to connect to the server: dial xxxx:443 i/o timout". "aws eks update-kubeconfig" can see that cluster and updates local context properly. What could be the problem?

Answer 1

Found out what was was missing. 443 had to be enabled in authorization rules