This page separates what CMP admins configure in CMP from behaviour and limits defined by Apache CloudStack on the virtual router. Customers enable Remote Access VPN in CMP; underlying VPN service, global tuning, and documented limits come from CloudStack.
Remote Access VPN (Road Warrior) lets an individual user connect from a laptop or PC over the internet to private VMs on a VPC or Isolated network — without exposing VM private IPs to the public internet.
VPN Users provide username/password credentials for Remote Access VPN. Users connect with an L2TP/IPsec client to the Source NAT public IP (VPC or Isolated network) where Remote Access VPN is enabled.
End-to-end setup for personal PC → private VM using Remote Access VPN. The same model applies to VPC and Isolated networks — enable VPN on the Source NAT public IP, create a VPN User, configure an L2TP/IPsec client.