- What's New
- Function Overview
- Service Overview
- Getting Started
-
User Guide
- Permissions Management
- VPC and Subnet
- Route Table and Route
- Virtual IP Address
-
Elastic Network Interface and Supplementary Network Interface
-
Elastic Network Interface
- Elastic Network Interface Overview
- Creating a Network Interface
- Viewing the Basic Information About a Network Interface
- Attaching a Network Interface to a Cloud Server
- Binding an EIP to a Network Interface
- Binding a Network Interface to a Virtual IP Address
- Detaching a Network Interface from an Instance or Unbinding an EIP from a Network Interface
- Changing Security Groups That Are Associated with a Network Interface
- Deleting a Network Interface
-
Supplementary Network Interfaces
- Supplementary Network Interface Overview
- Creating a Supplementary Network Interface
- Viewing the Basic Information About a Supplementary Network Interface
- Binding or Unbinding an EIP to or from a Supplementary Network Interface
- Changing Security Groups That Are Associated with a Supplementary Network Interface
- Deleting a Supplementary Network Interface
- Network Interface Configuration Examples
-
Elastic Network Interface
-
Access Control
- Access Control Overview
- Security Group
- Network ACL
- IP Address Group
-
VPC Peering Connection
- VPC Peering Connection Overview
- VPC Peering Connection Usage
- Creating a VPC Peering Connection to Connect Two VPCs in the Same Account
- Creating a VPC Peering Connection to Connect Two VPCs in Different Accounts
- Obtaining the Peer Project ID of a VPC Peering Connection
- Modifying a VPC Peering Connection
- Viewing VPC Peering Connections
- Deleting a VPC Peering Connection
- Modifying Routes Configured for a VPC Peering Connection
- Viewing Routes Configured for a VPC Peering Connection
- Deleting Routes Configured for a VPC Peering Connection
- IPv4/IPv6 Dual-Stack Network
- VPC Flow Log
- Elastic IP
- Shared Bandwidth
- Monitoring and Auditing
- Managing Quotas
- Best Practices
-
API Reference
- Before You Start
- API Overview
- Calling APIs
- APIs
-
API V3
- VPC
- Security Group
- Security Group Rule
- IP Address Group
-
Supplementary Network Interface
- Creating a Supplementary Network Interface
- Creating Supplementary Network Interfaces in Batches
- Querying Supplementary Network Interfaces
- Querying the Details of a Supplementary Network Interface
- Querying the Number of Supplementary Network Interfaces
- Updating a Supplementary Network Interface
- Deleting a Supplementary Network Interface
- Network ACL
- Port
-
Native OpenStack Neutron APIs (V2.0)
- API Version Information
- Port
- Network
- Subnet
- Router
-
Network ACL
- Querying Network ACL Rules
- Querying a Network ACL Rule
- Creating a Network ACL Rule
- Updating a Network ACL Rule
- Deleting a Network ACL Rule
- Querying Network ACL Policies
- Querying a Network ACL Policy
- Creating a Network ACL Policy
- Updating a Network ACL Policy
- Deleting a Network ACL Policy
- Inserting a Network ACL Rule
- Removing a Network ACL Rule
- Querying Network ACL Groups
- Querying a Network ACL Group
- Creating a Network ACL Group
- Updating a Network ACL Group
- Deleting a Network ACL Group
- Security Group
- Application Examples
-
Permissions and Supported Actions
- Introduction
- VPC
- Subnet
- Port
- VPC Peering Connection
- VPC Route
- Route Table
- Quota
- Private IP Address
- Security Group
- Security Group Rule
- VPC Tag
- Subnet Tag
- Port (OpenStack Neutron API)
- Network (OpenStack Neutron API)
- Subnet (OpenStack Neutron API)
- Router (OpenStack Neutron API)
- Network ACL (OpenStack Neutron API)
- Security Group (OpenStack Neutron API)
- Precautions for API Permissions
- FAQs
- Out-of-Date APIs
- Appendix
- SDK Reference
-
FAQs
-
Billing and Payments
- Will I Be Billed for Using the VPC Service?
- Why Is My VPC Still Being Billed After It Was Deleted?
- How Do I View My VPC Bills?
- How Is an EIP Charged?
- How Do I Change My EIP Billing Mode Between Pay-per-Use and Yearly/Monthly?
- How Do I Change the Billing Option of a Pay-per-Use EIP Between By Bandwidth and By Traffic?
-
VPCs and Subnets
- What Is Virtual Private Cloud?
- Which CIDR Blocks Are Available for the VPC Service?
- How Many VPCs Can I Create?
- Can Subnets Communicate with Each Other?
- What Subnet CIDR Blocks Are Available?
- Can I Change the CIDR Block of a Subnet?
- How Many Subnets Can I Create?
- How Do I Make the Changed DHCP Lease Time of a Subnet Take Effect Immediately?
- Why Can't I Delete My VPCs and Subnets?
- Can I Change the VPC of an ECS?
- Why Is the ECS IP Address Released After the System Time Is Changed?
- How Do I Change the DNS Server Address of an ECS?
-
EIPs
- How Do I Assign or Retrieve a Specific EIP?
- What Are the Differences Between EIP, Private IP Address, and Virtual IP Address?
- Can I Change the Dedicated Bandwidth Used by an EIP to a Shared Bandwidth?
- How Many ECSs Can I Bind an EIP To?
- How Do I Access an ECS with an EIP Bound from the Internet?
- What Is the EIP Assignment Policy?
- Can I Bind an EIP of an ECS to Another ECS?
- Can I Buy a Specific EIP?
- How Do I Query the Region of My EIPs?
- How Can I Unbind an Existing EIP from an Instance and Bind Another EIP to the Instance?
- Can I Bind an EIP to a Cloud Resource in Another Region?
- Can I Change the Region of an EIP?
- VPC Peering Connections
- Virtual IP Addresses
-
Bandwidth
- What Are Inbound Bandwidth and Outbound Bandwidth?
- What Are the Differences Between Static BGP and Dynamic BGP?
- How Do I Know If My EIP Bandwidth Limit Has Been Exceeded?
- What Are the Differences Between Public Bandwidth and Private Bandwidth?
- What Bandwidth Types Are Available?
- What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth?
- How Many EIPs Can I Add to Each Shared Bandwidth?
- Can I Increase a Yearly/Monthly Bandwidth and Decrease It Later?
- What Is the Relationship Between Bandwidth and Upload/Download Rate?
-
Connectivity
- Does a VPN Allow Communication Between Two VPCs?
- Why Cannot I Access Public Websites Through Domain Names or Access Internal Domain Names on the Cloud When My ECS Has Multiple NICs?
- What Are the Priorities of the Custom Route and EIP If Both Are Configured for an ECS to Enable the ECS to Access the Internet?
- Why Are There Intermittent Interruptions When a Local Host Accesses a Website Built on an ECS?
- Why Do ECSs Using Private IP Addresses in the Same Subnet Only Support One-Way Communication?
- Why Does Communication Fail Between Two ECSs in the Same VPC or Packet Loss Occur When They Communicate?
- Why Can't My ECS Use Cloud-init?
- Why Can't My ECS Access the Internet Even After an EIP Is Bound?
- Why Is My ECS Unable to Communicate at a Layer 2 or Layer 3 Network?
- How Do I Handle a BMS Network Failure?
- Why Does My ECS Fail to Obtain an IP Address?
- How Do I Handle a VPN or Direct Connect Connection Network Failure?
- Why Can My Server Be Accessed from the Internet But Cannot Access the Internet?
- Why Can't I Access Websites Using IPv6 Addresses After IPv4/IPv6 Dual Stack Is Configured?
- Why Does My ECS Fail to Communicate with Other After It Has Firewall Installed?
- Routing
-
Security
- Does a Modified Security Group Rule or a Network ACL Rule Take Effect Immediately for Existing Connections?
- Why Is Outbound Access on TCP Port 25 Blocked?
- How Do I Know the Instances Associated with a Security Group?
- Why Can't I Delete a Security Group?
- Can I Change the Security Group of an ECS?
- How Do I Configure a Security Group for Multi-Channel Protocols?
- Why Are Some Ports of ECSs Inaccessible?
- Why Is Access from a Specific IP Address Still Allowed After a Network ACL Rule That Denies the Access from the IP Address Has Been Added?
- Why Are My Security Group Rules Not Working?
-
Billing and Payments
Deploying Containers that Can Communicate with Each Other on Huawei Cloud ECSs
Scenarios
You can deploy containers that are not provided by Huawei Cloud container services on Huawei Cloud ECSs and enable the containers on different ECSs but in the same subnet to communicate with each other.
Solution Advantages
- Containers deployed on ECSs can use CIDR blocks that are not from those of the ECS VPCs, but use routes added to VPC route tables for data forwarding.
- You only need to add routes to the route tables to allow communications among containers, which is flexible and convenient.
Typical Topology
The network topology requirements are as follows:
- ECSs are in the same subnet. As shown in the following figure, the VPC subnet is 192.168.0.0/24, and the IP addresses of the ECS 1 and ECS 2 are 192.168.0.2 and 192.168.0.3, respectively.
- Containers are on CIDR blocks that are not from those of the VPC subnets that the ECSs belong to. Containers on the same ECS are on the same CIDR block, but containers on different ECSs are on different CIDR blocks. As shown in the following figure, the CIDR block of containers on ECS 1 is 10.0.2.0/24, and that on ECS 2 is 10.0.3.0/24.
- The next hop of the data packets sent to a container is the ECS where the container is deployed. As shown in the following figure, the next hop of the packets sent to CIDR block 10.0.2.0/24 is 192.168.0.2, and that of the packets sent to CIDR block 10.0.3.0/24 is 192.168.0.3.
![](https://support.huaweicloud.com/eu/bestpractice-vpc/en-us_image_0268337419.png)
Procedure
- Create VPCs.
For details, see Creating a VPC.
- Create ECSs.
For details, see Purchasing an ECS.
After the ECS is created, disable source/destination check on the ECS NIC, as shown in Figure 2.
- Deploy containers on ECSs.
You can use Docker CE to deploy containers. For details, see the documentation of Docker CE.
NOTE:
Containers on the same ECS must be on the same CIDR block and the CIDR blocks of containers on different ECSs cannot overlap.
- Add routes to the VPC route table.
Set the next hop of the packets sent to CIDR block 10.0.2.0/24 to 192.168.0.2, and set the next hop of the packets sent to CIDR block 10.0.3.0/24 to 192.168.0.3.
NOTE:
- By default, a VPC supports containers from a maximum of 50 different CIDR blocks. If containers from more different CIDR blocks need to be deployed in a VPC, apply for more route tables for the VPC.
- After a container is migrated to another ECS, you need to add routes to the route table of the ECS VPC.
- Add security group rules.
To use ping and traceroute commands to check the communications between containers, add the rules shown in Table 1 to the security group of the ECSs to allow ICMP and UDP traffic.
For details, see Adding a Security Group Rule.
Verification
Use the ping command to check whether the containers deployed on two different ECSs can communicate with each other.
Run the following commands to create a network connection my-net on ECS 1, set the CIDR block to be used by a container on ECS 1 to 10.0.2.0/24, and create the container that uses my-net.
$ docker network create --subnet 10.0.2.0/24 my-net $ docker run -d --name nginx --net my-net -p 8080:80 nginx:alpine
Run the following commands to create a network connection and container on ECS 2, and set the CIDR block to be used by the container to 10.0.3.0/24.
$ docker network create --subnet 10.0.3.0/24 my-net $ docker run -d --name nginx --net my-net -p 8080:80 nginx:alpine
Run the following command to set the default policy of the FORWARD chain in the filter table of iptables on the ECS to ACCEPT.
This operation is required because Docker sets the default policy of the FORWARD chain in the filter table of iptables to DROP for security purposes.
$ iptables -P FORWARD ACCEPT
Ping and traceroute 10.0.3.2 from 10.0.2.2. The ping and traceroute operations are successful, and the packet is tracerouted in the following sequence: 10.0.2.2 -> 10.0.2.1 -> 192.168.0.3 -> 10.0.3.2, which is consistent with the configured route forwarding rules.
[root@ecs1 ~]# docker exec -it nginx /bin/sh / # traceroute -d 10.0.3.2 traceroute to 10.0.3.2 (10.0.3.2), 30 hops max, 46 byte packets 1 10.0.2.1 (10.0.2.1) 0.007 ms 0.004 ms 0.007 ms 2 192.168.0.3 (192.168.0.3) 0.232 ms 0.165 ms 0.248 ms 3 10.0.3.2 (10.0.3.2) 0.366 ms 0.308 ms 0.158 ms / # ping 10.0.3.2 PING 10.0.3.2 (10.0.3.2): 56 data bytes 64 bytes from 10.0.3.2: seq=0 ttl=62 time=0.570 ms 64 bytes from 10.0.3.2: seq=1 ttl=62 time=0.343 ms 64 bytes from 10.0.3.2: seq=2 ttl=62 time=0.304 ms 64 bytes from 10.0.3.2: seq=3 ttl=62 time=0.319 ms
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.