AWS Certified Advanced Networking Specialty Practice Exam

What is necessary to ensure proper routing when terminating a VPN on an EC2 instance?

1. Enable source destination check on the instance

2. Disable source destination check on the instance

3. Use a public IP address

4. Restart the instance after configuration

The correct answer is: Disable source destination check on the instance

To ensure proper routing when terminating a VPN on an EC2 instance, disabling source/destination checking is essential. By default, EC2 instances in AWS perform source/destination checks, meaning they expect that the source of the traffic is the instance itself and that all outbound traffic is destined for the internet. When you set up a VPN server on an EC2 instance, it typically needs to route traffic on behalf of other instances or clients. Disabling the source/destination check allows the instance to act as a NAT device or to forward packets that are not directed to its assigned IP address. This is crucial in VPN scenarios where the instance needs to handle packets from a remote network and relay them appropriately without the default filtering that occurs when source/destination checks are enabled. By allowing the instance to manage routing for packets that do not originate from or are not intended for itself, you enable effective communication across the VPN tunnel. This configuration is particularly useful in scenarios involving VPNs that connect multiple networks, allowing the EC2 instance to serve as a bridge for routing traffic back and forth between the connected networks efficiently.