Step 13: Disable Source/Destination Checking
By default, AWS EC2 instances verify that they are either the source or destination of any traffic they send or receive. For VPN routing to work correctly, you must disable this check on all instances in your VPC.
Why Disable This Check?
When VPN traffic passes through your EC2 instances, the source IP address may be from your local network (e.g., 192.168.1.x), not from the VPC range. Without disabling this check, AWS will drop this traffic.
Disable Source/Destination Checking
Repeat these steps for each EC2 instance in your VPC:
- Navigate to EC2 Dashboard and select Instances.
- Select an EC2 instance (start with Public-Server).
- Click Actions.
- Select Networking.
- Click Change Source/Dest. Check.
- Click Yes, Disable to confirm.
- Repeat steps 2-6 for Private-Server and any other EC2 instances in your VPC.
Verification
After disabling the check:
- Select the EC2 instance.
- In the Description tab, look for Source/Dest. Check.
- Verify it shows Disabled.
Instances That Need This Change
| Instance | Source/Dest Check |
|---|---|
| Public-Server | Disabled |
| Private-Server | Disabled |
| Any additional instances | Disabled |
Important: This configuration must be applied to every EC2 instance operating within your VPC to ensure consistent network behavior.