Accessing an Interface VPC Endpoint Through Its IP Address or Private Domain Name

Scenarios

When you buy an interface VPC endpoint, an IP address is generated. If you select Create a Private Domain Name, a private domain name is also generated. You can use either the IP address or the private domain name to access the interface VPC endpoint to verify connectivity.

When you buy a gateway VPC endpoint, no IP address or private domain name is generated. You can use the endpoint of the cloud service to access the gateway VPC endpoint to verify the connectivity.

Constraints

The access to the IP address and private domain name of an interface VPC endpoint is limited by the backend VPC endpoint service type and protocol. In some scenarios, the IP address cannot be directly used for service access.

One VPC endpoint supports up to 3,000 concurrent connections.

Accessing an Interface VPC Endpoint Through Its IP Address or Private Domain Name

You can access an interface VPC endpoint through its IP address or private domain name to verify the connectivity.

1. Log in to the ECS in the VPC that the VPC endpoint belongs to.
2. Run the following command to test the connectivity based on the backend resource type:
   • Access through a VPC endpoint IP address: ping VPC endpoint IP address

     You can obtain the IP address of a VPC endpoint on the summary page of the VPC endpoint. If the backend service uses HTTP or HTTPS, use the curl command to access the service port:

     curl -sI http://IP address of the VPC endpoint:Port number

   • Access through a private domain name: curl -sI http://Private domain name of the VPC endpoint or curl -sI https://Private domain name of the VPC endpoint

     You can view the private domain name of a VPC endpoint on the summary page of the VPC endpoint.

     

     The security group must allow traffic over HTTP (port 80) and HTTPS (port 443) in the inbound direction so that the VPC of the VPC endpoint can access the service over HTTP or HTTPS. Support for HTTPS depends on the service.

Accessing a Gateway VPC Endpoint Through the Endpoint of a Cloud Service

When you create a gateway VPC endpoint, no IP address or private domain name is generated. You can use the endpoint of the cloud service to access the gateway VPC endpoint to verify the connectivity.

1. Check the route table of the VPC that the VPC endpoint belongs to.

   Check whether there is a route with the destination set to the target cloud service CIDR block and the next hop set to the gateway VPC endpoint.

2. Run the following command to access the endpoint of the cloud service to check the connectivity:

   The following uses OBS in EU-Dublin as an example:

   curl -I https://Bucket name.obs.eu-west-101.myhuaweicloud.eu

   You can obtain the endpoint of a cloud service on the Regions and Endpoints page.

Related Operations

If you select Create a Private Domain Name when purchasing a VPC endpoint, the system automatically adds the generated private domain name to the DNS service and adds an A record set for the domain name to resolve the private domain name to the IP address of the VPC endpoint.

You can view the corresponding domain name and its record sets on the DNS console.

1. Log in to the management console.
2. Hover the cursor over in the upper left corner. In the service list, choose Networking > Domain Name Service.

   The DNS console is displayed.

3. Go to the VPC endpoint list page.
4. In the private zone list, click the private domain name of the VPC endpoint.

   The Record Sets page is displayed.

5. In the record set list, locate the A record set that maps the private domain name of the VPC endpoint to its IP address.

FAQs

• What Can I Do If DNS Resolution Works But Layer 7 Services Cannot Access an Interface VPC Endpoint Using curl?

  This problem is usually caused by the HTTP Host header or TLS SNI not matching the verification requirements of the backend gateway. You can run the following command to direct traffic to the VPC endpoint IP address while carrying the Host/SNI of the official domain name for verification:

  curl -v --resolve "VPC endpoint private domain name:443:VPC endpoint IP address" https://VPC endpoint private domain name

  You can view the private domain name and IP address of the VPC endpoint on the Summary page of the VPC endpoint.

• Why Does curl Access to an Interface VPC Endpoint Fail When a Custom A or CNAME Record Set Points to the VPC Endpoint IP Address?

  This problem is caused by the Layer 7 Host/SNI verification restrictions. Preset cloud service VPC Endpoint does not support direct access through custom domain names.