Updated on 2024-05-06 GMT+08:00

VPC Connectivity

Accessing the Internet

Cloud resources in a VPC can use the following cloud services to connect to the Internet.

Table 1 Accessing the Internet

Cloud Service

Application Scenario

Description

Reference

EIP

Single ECS accesses the Internet.

You can assign an EIP and bind it to an ECS so that the ECS can access the Internet or provide services accessible from the Internet.

An EIP can be bound to an ECS to enable Internet access, or unbound to disable access.

Shared bandwidths can be used to lower costs.

Configuring the VPC of ECSs That Access the Internet Using EIPs

NAT Gateway

Multiple ECSs share an EIP to access the Internet.

A NAT gateway offers both source network address translation (SNAT) and destination network address translation (DNAT). SNAT allows multiple ECSs in the same VPC to share EIPs to access the Internet. In this way, you can reduce management costs and prevent the EIPs of ECSs from being exposed to the Internet. DNAT implements port-level data forwarding. It maps EIP ports to ECS ports so that the ECSs in a VPC can share the same EIP and bandwidth to provide Internet-accessible services. However, DNAT does not balance traffic.

Using SNAT to Access the Internet

Using DNAT to Provide Services Accessible from the Internet

ELB

Use load balancers provided by the ELB service to evenly distribute incoming traffic across multiple ECSs in high-concurrency scenarios, such as e-commerce.

Load balancers distribute traffic across multiple backend ECSs, balancing the workload on each ECS (at Layer 4 or Layer 7). You can bind EIPs to ECSs to allow the access from the Internet.

ELB expands the service capabilities of your applications and improves availability by eliminating single points of failures.

What Is ELB?

Connecting VPCs

You can connect VPCs using the following cloud services.

Table 2 Connecting VPCs

Cloud Service

Application Scenario

Description

Reference

VPC Peering

Connect VPCs in the same region.

You can request a VPC peering connection with another VPC in your account or in another account, but the two VPCs must be in the same region. VPC peering connections are free of charge.

Creating a VPC Peering Connection with Another VPC in Your Account

Creating a VPC Peering Connection with a VPC in Another Account

VPN

Use VPN to connect VPCs across regions at a low cost.

VPN uses an encrypted communications tunnel to connect VPCs in different regions and sends traffic over the Internet. It is inexpensive, easy to configure, and easy to use. However, VPN connections will be affected by the Internet quality.

-

Connecting to an On-premises Data Center (IDC)

If you have an on-premises data center and you do not want to migrate all of your services to the cloud, you can build a hybrid cloud, so that you can keep core data in your data center.

Table 3 Connecting to an on-premises data center

Cloud Service

Application Scenario

Description

Reference

VPN

Use VPN to connect a VPC to an on-premises data center at a low cost.

VPN uses an encrypted communications tunnel to connect a VPC on the cloud to an on-premises data center and sends traffic over the Internet. It is inexpensive, easy to configure, and easy to use. However, VPN connections will be affected by the Internet quality.

-

Direct Connect

Use a physical connection to connect a VPC to an on-premises data center.

Direct Connect provides physical connections between VPCs and data centers. It features low latency and is very secure. Direct Connect is a good choice if you have strict requirements on network transmission quality and security.

Accessing Multiple VPCs over the Same Connection