Why do we need to disable source/destination checks on an EC2 instance?

You typically don’t need to change the default settings unless you're using the instance to relay traffic, like with a NAT setup. When other instances send packets to the NAT instance, they need it to accept those packets, even if they’re not addressed directly to its IP, hence the check should be disabled.

Exactly! If your EC2 instance is serving as a NAT gateway, the source/destination check needs to be off. This way, it can proxy the traffic correctly. Without this, packets meant for other destinations would be dropped, which defeats the purpose of using it as a proxy.

Just to add, if your instance is in a public subnet, it might also receive random traffic directed to its public IP. Disabling the check allows it to handle those requests properly.

Disabling source/destination checks is usually necessary when you're setting up your EC2 instance to act as a router, NAT, or VPN. This allows the instance to forward packets that aren’t directly addressed to it, which is useful in those specific roles. For a standard instance, you generally won't need to adjust this setting unless you're configuring it to relay traffic.