- What's New
- Function Overview
- Service Overview
- Getting Started
-
User Guide
- Permissions Management
- VPC and Subnet
- Route Table and Route
- Virtual IP Address
-
Elastic Network Interface and Supplementary Network Interface
-
Elastic Network Interface
- Elastic Network Interface Overview
- Creating a Network Interface
- Viewing the Basic Information About a Network Interface
- Attaching a Network Interface to a Cloud Server
- Binding an EIP to a Network Interface
- Binding a Network Interface to a Virtual IP Address
- Detaching a Network Interface from an Instance or Unbinding an EIP from a Network Interface
- Changing Security Groups That Are Associated with a Network Interface
- Deleting a Network Interface
-
Supplementary Network Interfaces
- Supplementary Network Interface Overview
- Creating a Supplementary Network Interface
- Viewing the Basic Information About a Supplementary Network Interface
- Binding or Unbinding an EIP to or from a Supplementary Network Interface
- Changing Security Groups That Are Associated with a Supplementary Network Interface
- Deleting a Supplementary Network Interface
-
Network Interface Configuration Examples
- Binding an EIP to the Extended Network Interface of an ECS to Enable Internet Access
-
Configuring Policy-based Routes for an ECS with Multiple Network Interfaces
- Overview
- Collecting ECS Network Information
- Configuring IPv4 and IPv6 Policy-based Routes for a Linux ECS with Multiple Network Interfaces (CentOS)
- Configuring IPv4 and IPv6 Policy-based Routes for a Linux ECS with Multiple Network Interfaces (Ubuntu)
- Configuring IPv4 and IPv6 Policy-based Routes for a Windows ECS with Multiple Network Interfaces
-
Elastic Network Interface
-
Access Control
- Access Control Overview
-
Security Group
- Security Group and Security Group Rule Overview
- Default Security Groups
- Security Group Examples
- Common ECS Ports
- Managing a Security Group
-
Managing Security Group Rules
- Adding a Security Group Rule
- Fast-Adding Security Group Rules
- Allowing Common Ports with a Few Clicks
- Modifying a Security Group Rule
- Replicating a Security Group Rule
- Enabling or Disabling One or More Security Group Rules
- Importing and Exporting Security Group Rules
- Deleting One or More Security Group Rules
- Querying Security Group Rule Changes
- Managing Instances Added to a Security Group
- Network ACL
- IP Address Group
-
VPC Peering Connection
- VPC Peering Connection Overview
- VPC Peering Connection Usage
- Creating a VPC Peering Connection to Connect Two VPCs in the Same Account
- Creating a VPC Peering Connection to Connect Two VPCs in Different Accounts
- Obtaining the Peer Project ID of a VPC Peering Connection
- Modifying a VPC Peering Connection
- Viewing VPC Peering Connections
- Deleting a VPC Peering Connection
- Modifying Routes Configured for a VPC Peering Connection
- Viewing Routes Configured for a VPC Peering Connection
- Deleting Routes Configured for a VPC Peering Connection
- VPC Sharing
-
Edge Gateway
- Edge Gateway Overview
- Buying an Edge Gateway
- Associating VPCs with or Disassociating VPCs from an Edge Gateway
- Managing Edge Gateways
- Managing the Tags of an Edge Gateway
- Creating an Edge Connection
- Binding or Unbinding a Global Connection Bandwidth to and from an Edge Connection
- Managing Edge Connections
- IPv4/IPv6 Dual-Stack Network
- VPC Flow Log
-
Traffic Mirroring
- Traffic Mirroring
- Mirror Filters
-
Mirror Sessions
- Creating a Mirror Session
- Enabling or Disabling a Mirror Session
- Associating Mirror Sources with a Mirror Session
- Disassociating Mirror Sources from a Mirror Session
- Changing the Mirror Filter for a Mirror Session
- Changing the Mirror Target of a Mirror Session
- Modifying the Basic Information About a Mirror Session
- Viewing the Details About a Mirror Session
- Deleting a Mirror Session
- Traffic Mirroring Example Scenarios
- Monitoring and Auditing
- Managing Quotas
- Best Practices
-
API Reference
- Before You Start
- API Overview
- Calling APIs
- APIs
-
API V3
- VPC
- Security Group
- Security Group Rule
- IP Address Group
-
Supplementary Network Interface
- Creating a Supplementary Network Interface
- Creating Supplementary Network Interfaces in Batches
- Querying Supplementary Network Interfaces
- Querying the Details of a Supplementary Network Interface
- Querying the Number of Supplementary Network Interfaces
- Updating a Supplementary Network Interface
- Deleting a Supplementary Network Interface
-
Traffic Mirror Sessions
- Querying Traffic Mirror Sessions
- Querying Details About a Traffic Mirror Session
- Creating a Traffic Mirror Session
- Updating a Traffic Mirror Session
- Deleting a Traffic Mirror Session
- Disassociating a Traffic Mirror Source from a Traffic Mirror Session
- Associating a Traffic Mirror Source with a Traffic Mirror Session
- Traffic Mirror Filters
- Traffic Mirror Filter Rules
- Network ACL
- Network ACL Tag Management
- Port
-
Native OpenStack Neutron APIs (V2.0)
- API Version Information
- Port
- Network
- Subnet
- Router
-
Network ACL
- Querying Network ACL Rules
- Querying a Network ACL Rule
- Creating a Network ACL Rule
- Updating a Network ACL Rule
- Deleting a Network ACL Rule
- Querying Network ACL Policies
- Querying a Network ACL Policy
- Creating a Network ACL Policy
- Updating a Network ACL Policy
- Deleting a Network ACL Policy
- Inserting a Network ACL Rule
- Removing a Network ACL Rule
- Querying Network ACL Groups
- Querying a Network ACL Group
- Creating a Network ACL Group
- Updating a Network ACL Group
- Deleting a Network ACL Group
- Security Group
- Application Examples
-
Permissions and Supported Actions
- Introduction
- VPC
- Subnet
- Port
- VPC Peering Connection
- VPC Route
- Route Table
- Quota
- Private IP Address
- Security Group
- Security Group Rule
- VPC Tag
- Subnet Tag
- VPC Flow Log
- Port (OpenStack Neutron API)
- Network (OpenStack Neutron API)
- Subnet (OpenStack Neutron API)
- Router (OpenStack Neutron API)
- Network ACL (OpenStack Neutron API)
- Security Group (OpenStack Neutron API)
- VPC (V3)
- Security Group (V3)
- Security Group Rule (V3)
- IP Address Group (V3)
- Supplementary Network Interface (V3)
- Mirror Session (V3)
- Mirror Filter (V3)
- Mirror Filter Rule (V3)
- Network ACL (V3)
- Network ACL Tag (V3)
- Port (V3)
- Precautions for API Permissions
- FAQs
- Out-of-Date APIs
- Appendix
- SDK Reference
-
FAQs
-
Billing and Payments
- Will I Be Billed for Using the VPC Service?
- Why Is My VPC Still Being Billed After It Was Deleted?
- How Do I View My VPC Bills?
- How Is an EIP Charged?
- How Do I Change My EIP Billing Mode Between Pay-per-Use and Yearly/Monthly?
- How Do I Change the Billing Option of a Pay-per-Use EIP Between By Bandwidth and By Traffic?
-
VPCs and Subnets
- What Is Virtual Private Cloud?
- Which CIDR Blocks Are Available for the VPC Service?
- How Many VPCs Can I Create?
- Can Subnets Communicate with Each Other?
- What Subnet CIDR Blocks Are Available?
- Can I Change the CIDR Block of a Subnet?
- How Many Subnets Can I Create?
- How Do I Make the Changed DHCP Lease Time of a Subnet Take Effect Immediately?
- How Can I Make a Domain Name in a Subnet Take Effect Immediately After Being Changed?
- Why Can't I Delete My VPCs and Subnets?
- Can I Change the VPC of an ECS?
- Why Is the ECS IP Address Released After the System Time Is Changed?
- How Do I Change the DNS Server Address of an ECS?
-
EIPs
- How Do I Assign or Retrieve a Specific EIP?
- What Are the Differences Between EIPs, Private IP Addresses, and Virtual IP Addresses?
- Can I Change the Dedicated Bandwidth Used by an EIP to a Shared Bandwidth?
- How Many ECSs Can I Bind an EIP To?
- How Do I Access an ECS with an EIP Bound from the Internet?
- What Is the EIP Assignment Policy?
- Can I Bind an EIP of an ECS to Another ECS?
- Can I Buy a Specific EIP?
- How Do I Query the Region of My EIPs?
- How Can I Unbind an Existing EIP from an Instance and Bind Another EIP to the Instance?
- Can I Bind an EIP to a Cloud Resource in Another Region?
- Can I Change the Region of an EIP?
- VPC Peering Connections
- Virtual IP Addresses
-
Bandwidth
- What Are Inbound Bandwidth and Outbound Bandwidth?
- What Are the Differences Between Static BGP, Dynamic BGP, and Premium BGP?
- How Do I Know If My EIP Bandwidth Has Been Exceeded?
- What Are the Differences Between Public Bandwidth and Private Bandwidth?
- What Bandwidth Types Are Available?
- What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth? Can a Dedicated Bandwidth Be Changed to a Shared Bandwidth or the Other Way Around?
- How Many EIPs Can I Add to Each Shared Bandwidth?
- Can I Increase a Yearly/Monthly Bandwidth and Decrease It Later?
- What Is the Relationship Between Bandwidth and Upload/Download Rate?
-
Connectivity
- Does a VPN Allow Communication Between Two VPCs?
- Why Cannot I Access Public Websites Through Domain Names or Access Internal Domain Names on the Cloud When My ECS Has Multiple Network Interfaces?
- What Are the Priorities of the Custom Route and EIP If Both Are Configured for an ECS to Enable the ECS to Access the Internet?
- Why Are There Intermittent Interruptions When a Local Host Accesses a Website Built on an ECS?
- Why Do ECSs Using Private IP Addresses in the Same Subnet Only Support One-Way Communication?
- Why Does Communication Fail Between Two ECSs in the Same VPC or Packet Loss Occur When They Communicate?
- Why Can't My ECS Use Cloud-init?
- Why Can't My ECS Access the Internet Even After an EIP Is Bound?
- Why Is My ECS Unable to Communicate at a Layer 2 or Layer 3 Network?
- How Do I Handle a BMS Network Failure?
- Why Does My ECS Fail to Obtain an IP Address?
- How Do I Handle a VPN or Direct Connect Connection Network Failure?
- Why Can My Server Be Accessed from the Internet But Cannot Access the Internet?
- Why Can't I Access Websites Using IPv6 Addresses After IPv4/IPv6 Dual Stack Is Configured?
- Why Does My ECS Fail to Communicate with Other After It Has Firewall Installed?
- Routing
-
Security
- Does a New Security Group Rule or a Network ACL Rule Take Effect Immediately for Existing Connections?
- Why Is Outbound Access on TCP Port 25 Blocked?
- How Do I Know the Instances Associated with a Security Group?
- Why Can't I Delete a Security Group?
- Can I Change the Security Group of an ECS?
- How Do I Configure a Security Group for Multi-Channel Protocols?
- Why Are Some Ports of ECSs Inaccessible?
- Why Is Access from a Specific IP Address Still Allowed After a Network ACL Rule That Denies the Access from the IP Address Has Been Added?
- Why Are My Security Group Rules Not Working?
-
Billing and Payments
- Videos
- Glossary
-
More Documents
-
User Guide (ME-Abu Dhabi Region)
- Service Overview
- Getting Started
- VPC and Subnet
- Route Tables
-
Virtual IP Address
- Virtual IP Address Overview
- Assigning a Virtual IP Address
- Binding a Virtual IP Address to an EIP or ECS
- Binding a Virtual IP Address to an EIP
- Unbinding a Virtual IP Address from an Instance
- Unbinding a Virtual IP Address from an EIP
- Releasing a Virtual IP Address
- Disabling IP Forwarding on the Standby ECS
- Disabling Source/Destination Check for an ECS NIC
-
Elastic Network Interface and Supplementary Network Interface
-
Elastic Network Interface
- Elastic Network Interface Overview
- Creating a Network Interface
- Viewing Basic Information About a Network Interface
- Attaching a Network Interface to an Instance
- Binding a Network Interface to an EIP
- Binding a Network Interface to a Virtual IP Address
- Detaching a Network Interface from an Instance or Unbinding an EIP from a Network Interface
- Changing Security Groups That Are Associated with a Network Interface
- Deleting a Network Interface
-
Supplementary Network Interfaces
- Supplementary Network Interface Overview
- Creating a Supplementary Network Interface
- Viewing Basic Information About a Supplementary Network Interface
- Binding or Unbinding a Supplementary Network Interface to or from an EIP
- Changing Security Groups That Are Associated with a Supplementary Network Interface
- Deleting a Supplementary Network Interface
-
Elastic Network Interface
-
Access Control
- What Is Access Control?
- Security Group
- Network ACL
-
VPC Peering Connection
- VPC Peering Connection Overview
- VPC Peering Connection Usage Examples
- Creating a VPC Peering Connection with Another VPC in Your Account
- Creating a VPC Peering Connection with a VPC in Another Account
- Obtaining the Peer Project ID of a VPC Peering Connection
- Modifying a VPC Peering Connection
- Viewing VPC Peering Connections
- Deleting a VPC Peering Connection
- Modifying Routes Configured for a VPC Peering Connection
- Viewing Routes Configured for a VPC Peering Connection
- Deleting Routes Configured for a VPC Peering Connection
- VPC Flow Log
- Elastic IP
- Shared Bandwidth
- Monitoring
-
FAQ
- General Questions
- VPCs and Subnets
- EIPs
- VPC Peering Connections
- Bandwidth
-
Connectivity
- Does a VPN Allow Communication Between Two VPCs?
- Why Are Internet or Internal Domain Names in the Cloud Inaccessible Through Domain Names When My ECS Has Multiple NICs?
- What Are the Priorities of the Custom Route and EIP If Both Are Configured for an ECS to Enable the ECS to Access the Internet?
- Why Can't My ECS Access the Internet Even After an EIP Is Bound?
-
Routing
- Can a Route Table Span Multiple VPCs?
- How Many Routes Can a Route Table Contain?
- Are There Any Restrictions on Using a Route Table?
- Do the Same Routing Priorities Apply to Direct Connect Connections and Custom Routes in the Same VPC?
- Are There Different Routing Priorities of the VPN and Custom Routes in the Same VPC?
- Security
- Change History
-
API Reference
- Before You Start
- API Overview
- Calling APIs
- Getting Started
- VPC APIs (V1/V2)
-
VPC APIs (V3)
- VPC
- Security Group
- Security Group Rule
- IP Address Group
-
Supplementary Network Interface
- Creating a Supplementary Network Interface
- Creating Supplementary Network Interfaces in Batches
- Querying Supplementary Network Interfaces
- Querying the Details of a Supplementary Network Interface
- Querying the Number of Supplementary Network Interfaces
- Updating a Supplementary Network Interface
- Deleting a Supplementary Network Interface
- Network ACL
- Network ACL Tag Management
-
Native OpenStack Neutron APIs (V2.0)
- API Version Information
- Port
- Network
- Subnet
- Router
-
Network ACL
- Querying Network ACL Rules
- Querying a Network ACL Rule
- Creating a Network ACL Rule
- Updating a Network ACL Rule
- Deleting a Network ACL Rule
- Querying Network ACL Policies
- Querying a Network ACL Policy
- Creating a Network ACL Policy
- Updating a Network ACL Policy
- Deleting a Network ACL Policy
- Inserting a Network ACL Rule
- Removing a Network ACL Rule
- Querying Network ACL Groups
- Querying a Network ACL Group
- Creating a Network ACL Group
- Updating a Network ACL Group
- Deleting a Network ACL Group
- Security Group
-
Permissions and Supported Actions
- Introduction
- VPC
- Subnet
- Port
- VPC Peering Connection
- VPC Route
- Route Table
- Quota
- Private IP Address
- Security Group
- Security Group Rule
- VPC Tag
- Subnet Tag
- Port (OpenStack Neutron API)
- Network (OpenStack Neutron API)
- Subnet (OpenStack Neutron API)
- Router (OpenStack Neutron API)
- Network ACL (OpenStack Neutron API)
- Security Group (OpenStack Neutron API)
- VPC (V3)
- Security Group (V3)
- Security Group Rule (V3)
- IP Address Group (V3)
- Supplementary Network Interface (V3)
- Network ACL (V3)
- Network ACL Tag (V3)
- Precautions for API Permissions
- Out-of-Date APIs
- Appendix
- Change History
-
User Guide (Paris Regions)
- Service Overview
- Getting Started
- VPC and Subnet
-
Access Control
- Differences Between Security Groups and Network ACLs
- Security Group
- Network ACL
- Elastic IP
- Shared Bandwidth
- Route Tables
-
VPC Peering Connection
- VPC Peering Connection Overview
- VPC Peering Connection Usage Examples
- Creating a VPC Peering Connection with Another VPC in Your Account
- Creating a VPC Peering Connection with a VPC in Another Account
- Obtaining the Peer Project ID of a VPC Peering Connection
- Modifying a VPC Peering Connection
- Viewing VPC Peering Connections
- Deleting a VPC Peering Connection
- Modifying Routes Configured for a VPC Peering Connection
- Viewing Routes Configured for a VPC Peering Connection
- Deleting Routes Configured for a VPC Peering Connection
- VPC Flow Log
-
Virtual IP Address
- Virtual IP Address Overview
- Assigning a Virtual IP Address
- Binding a Virtual IP Address to an EIP or ECS
- Binding a Virtual IP Address to an EIP
- Unbinding a Virtual IP Address from an Instance
- Unbinding a Virtual IP Address from an EIP
- Releasing a Virtual IP Address
- Disabling IP Forwarding on the Standby ECS
- Disabling Source/Destination Check for an ECS NIC
- Interconnecting with CTS
- Monitoring
-
FAQ
- General Questions
- Billing and Payments
- VPCs and Subnets
-
EIPs
- What Are the Differences Between EIP, Private IP Address, and Virtual IP Address?
- How Do I Access the Internet Using an EIP Bound to an Extension NIC?
- What Are the Differences Between the Primary and Extension NICs of ECSs?
- Can an EIP That Uses Dedicated Bandwidth Be Changed to Use Shared Bandwidth?
- Can I Bind an EIP to Multiple ECSs?
- How Do I Access an ECS with an EIP Bound from the Internet?
- Can I Bind an EIP of an ECS to Another ECS?
- How Do I Unbind an EIP from an Instance and Bind a New EIP to the Instance?
- Can I Bind an EIP to a Cloud Resource in Another Region?
- Can I Change the Region of My EIP?
- VPC Peering Connections
- Virtual IP Addresses
-
Bandwidth
- What Are Inbound Bandwidth and Outbound Bandwidth?
- How Do I Know If My EIP Bandwidth Limit Has Been Exceeded?
- What Are the Differences Between Public Bandwidth and Private Bandwidth?
- What Is the Bandwidth Size Range?
- What Bandwidth Types Are Available?
- What Are the Differences Between a Dedicated Bandwidth and a Shared Bandwidth?
- Is There a Limit to the Number of EIPs That Can Be Added to Each Shared Bandwidth?
- What Is the Relationship Between Bandwidth and Upload/Download Rate?
-
Connectivity
- Does a VPN Allow Communication Between Two VPCs?
- Why Are Internet or Internal Domain Names in the Cloud Inaccessible Through Domain Names When My ECS Has Multiple NICs?
- What Are the Priorities of the Custom Route and EIP If Both Are Configured for an ECS to Enable the ECS to Access the Internet?
- Why Are There Intermittent Interruptions When a Local Host Accesses a Website Built on an ECS?
- Why Do ECSs Using Private IP Addresses in the Same Subnet Only Support One-Way Communication?
- Why Does Communication Fail Between Two ECSs in the Same VPC or Packet Loss Occur When They Communicate?
- Why Can't My ECS Use Cloud-init?
- Why Can't My ECS Access the Internet Even After an EIP Is Bound?
- Why Does My ECS Fail to Obtain an IP Address?
- How Do I Handle a VPN or Direct Connect Connection Network Failure?
- Why Can My Server Be Accessed from the Internet But Cannot Access the Internet?
- Why Can't I Access Websites Using IPv6 Addresses After IPv4/IPv6 Dual Stack Is Configured?
- Why Does My ECS Fail to Communicate with Other After It Has Firewall Installed?
-
Routing
- How Do I Configure Policy-Based Routes for an ECS with Multiple NICs?
- Can a Route Table Span Multiple VPCs?
- How Many Routes Can a Route Table Contain?
- Are There Any Restrictions on Using a Route Table?
- Do the Same Routing Priorities Apply to Direct Connect Connections and Custom Routes in the Same VPC?
- Are There Different Routing Priorities of the VPN and Custom Routes in the Same VPC?
-
Security
- Are the Security Group Rules Considered the Same If All Parameters Except Their Description Are the Same?
- How Do I Know the Instances Associated with a Security Group?
- Why Can't I Delete a Security Group?
- Can I Change the Security Group of an ECS?
- How Do I Configure a Security Group for Multi-Channel Protocols?
- Does a Modified Security Group Rule or a Network ACL Rule Take Effect Immediately for Existing Connections?
- Which Security Group Rule Has a High Priority When Multiple Security Group Rules Conflict?
- Why Is Access from a Specific IP Address Still Allowed After a Network ACL Rule That Denies the Access from the IP Address Has Been Added?
- Why Do My Security Group Rules Not Take Effect?
- Change History
-
API Reference (Paris Regions)
- Before You Start
- API Overview
- Calling APIs
- Getting Started
-
APIs
- Virtual Private Cloud
- Subnet
- EIP
- Bandwidth
- Bandwidth (V2.0)
- Quota
- Private IP Address
- Security Group
- VPC Peering Connection
- VPC Route
- Route Table
- VPC Tag Management
- Subnet Tag Management
- EIP Tag Management
- VPC Flow Log
-
Virtual IP Address
- Virtual IP Address Overview
- Binding an ECS to a Virtual IP Address
- Accessing a Virtual IP Address Using an EIP
- Using a VPN to Access the Virtual IP Address
- Using a Direct Connect Connection to Access the Virtual IP Address
- Using a VPC Peering Connection to Access the Virtual IP Address
- Disabling Source and Destination Check (HA Load Balancing Cluster Scenario)
- API V3
-
Native OpenStack Neutron APIs (V2.0)
- API Version Information
- Port
- Network
- Subnet
- Router
- Floating IP Address
-
Network ACL
- Querying Network ACL Rules
- Querying a Network ACL Rule
- Creating a Network ACL Rule
- Updating a Network ACL Rule
- Deleting a Network ACL Rule
- Querying Network ACL Policies
- Querying a Network ACL Policy
- Creating a Network ACL Policy
- Updating a Network ACL Policy
- Deleting a Network ACL Policy
- Inserting a Network ACL Rule
- Removing a Network ACL Rule
- Querying Network ACL Groups
- Querying a Network ACL Group
- Creating a Network ACL Group
- Updating a Network ACL Group
- Deleting a Network ACL Group
- Security Group
- Application Examples
-
Permissions Policies and Supported Actions
- VPC
- Subnet
- EIP
- Bandwidth
- Bandwidth (V2.0)
- EIP V3
- VPC Peering Connection
- VPC Route
- Route Table
- Quota
- Private IP Address
- Security Group
- VPC Flow Log
- Port (OpenStack Neutron API)
- Network (OpenStack Neutron API)
- Subnet (OpenStack Neutron API)
- Router (OpenStack Neutron API)
- Floating IP Address (OpenStack Neutron API)
- Network ACL (OpenStack Neutron API)
- Security Group (OpenStack Neutron API)
- Precautions for API Permissions
- Appendix
- Change History
-
User Guide (Kuala Lumpur Region)
- Service Overview
- Getting Started
- VPC and Subnet
- Route Tables
- Virtual IP Address
-
Access Control
- What Is Access Control?
- Security Group
- Network ACL
-
VPC Peering Connection
- VPC Peering Connection Overview
- VPC Peering Connection Usage Examples
- Creating a VPC Peering Connection with Another VPC in Your Account
- Creating a VPC Peering Connection with a VPC in Another Account
- Obtaining the Peer Project ID of a VPC Peering Connection
- Modifying a VPC Peering Connection
- Viewing VPC Peering Connections
- Deleting a VPC Peering Connection
- Modifying Routes Configured for a VPC Peering Connection
- Viewing Routes Configured for a VPC Peering Connection
- Deleting Routes Configured for a VPC Peering Connection
- VPC Flow Log
- Elastic IP
- Shared Bandwidth
- Interconnecting with CTS
- Monitoring
-
FAQ
- General Questions
- VPCs and Subnets
- EIPs
- VPC Peering Connections
- Bandwidth
- Connectivity
-
Routing
- Can a Route Table Span Multiple VPCs?
- How Many Routes Can a Route Table Contain?
- Are There Any Restrictions on Using a Route Table?
- Do the Same Routing Priorities Apply to Direct Connect Connections and Custom Routes in the Same VPC?
- Are There Different Routing Priorities of the VPN and Custom Routes in the Same VPC?
- Security
- Change History
-
API Reference (Kuala Lumpur Region)
- Before You Start
- API Overview
- Calling APIs
- Getting Started
- APIs
-
Native OpenStack Neutron APIs (V2.0)
- API Version Information
- Port
- Network
- Subnet
- Router
-
Network ACL
- Querying Network ACL Rules
- Querying a Network ACL Rule
- Creating a Network ACL Rule
- Updating a Network ACL Rule
- Deleting a Network ACL Rule
- Querying Network ACL Policies
- Querying a Network ACL Policy
- Creating a Network ACL Policy
- Updating a Network ACL Policy
- Deleting a Network ACL Policy
- Inserting a Network ACL Rule
- Removing a Network ACL Rule
- Querying Network ACL Groups
- Querying a Network ACL Group
- Creating a Network ACL Group
- Updating a Network ACL Group
- Deleting a Network ACL Group
- Security Group
-
Permissions Policies and Supported Actions
- VPC
- Subnet
- Port
- VPC Peering Connection
- Quota
- Private IP Address
- Security Group
- Security Group Rule
- VPC Tags
- Subnet Tags
- Port (OpenStack Neutron API)
- Network (OpenStack Neutron API)
- Subnet (OpenStack Neutron API)
- Router (OpenStack Neutron API)
- Network ACL (OpenStack Neutron API)
- Security Group (OpenStack Neutron API)
- Precautions for API Permissions
- Out-of-Date APIs
- Appendix
- Change History
-
User Guide (Ankara Region)
- Service Overview
- Getting Started
- VPC and Subnet
- Route Tables
-
Virtual IP Address
- Virtual IP Address Overview
- Assigning a Virtual IP Address
- Binding a Virtual IP Address to an EIP or ECS
- Binding a Virtual IP Address to an EIP
- Unbinding a Virtual IP Address from an Instance
- Unbinding a Virtual IP Address from an EIP
- Releasing a Virtual IP Address
- Disabling IP Forwarding on the Standby ECS
- Disabling Source/Destination Check for an ECS NIC
-
Elastic Network Interface and Supplementary Network Interface
-
Elastic Network Interface
- Elastic Network Interface Overview
- Creating a Network Interface
- Viewing Basic Information About a Network Interface
- Attaching a Network Interface to an Instance
- Binding a Network Interface to an EIP
- Binding a Network Interface to a Virtual IP Address
- Detaching a Network Interface from an Instance or Unbinding an EIP from a Network Interface
- Changing Security Groups That Are Associated with a Network Interface
- Deleting a Network Interface
-
Supplementary Network Interfaces
- Supplementary Network Interface Overview
- Creating a Supplementary Network Interface
- Viewing Basic Information About a Supplementary Network Interface
- Binding or Unbinding a Supplementary Network Interface to or from an EIP
- Changing Security Groups That Are Associated with a Supplementary Network Interface
- Deleting a Supplementary Network Interface
-
Elastic Network Interface
-
Access Control
- What Is Access Control?
- Security Group
- Network ACL
-
VPC Peering Connection
- VPC Peering Connection Overview
- VPC Peering Connection Usage Examples
- Creating a VPC Peering Connection with Another VPC in Your Account
- Creating a VPC Peering Connection with a VPC in Another Account
- Obtaining the Peer Project ID of a VPC Peering Connection
- Modifying a VPC Peering Connection
- Viewing VPC Peering Connections
- Deleting a VPC Peering Connection
- Modifying Routes Configured for a VPC Peering Connection
- Viewing Routes Configured for a VPC Peering Connection
- Deleting Routes Configured for a VPC Peering Connection
- VPC Flow Log
- Elastic IP
- Shared Bandwidth
- Monitoring
- Permissions Management
-
FAQ
- General Questions
- VPCs and Subnets
- EIPs
- VPC Peering Connections
- Bandwidth
- Connectivity
- Routing
-
Security
- Does a Modified Security Group Rule or a Network ACL Rule Take Effect Immediately for Existing Connections?
- Why Can't I Delete a Security Group?
- Can I Change the Security Group of an ECS?
- How Do I Configure a Security Group for Multi-Channel Protocols?
- Which Security Group Rule Has a High Priority When Multiple Security Group Rules Conflict?
- Change History
-
API Reference (Ankara Region)
- Before You Start
- API Overview
- Calling APIs
- Getting Started
- APIs
- API V3
-
Native OpenStack Neutron APIs (V2.0)
- API Version Information
- Port
- Network
- Subnet
- Router
- Floating IP Address
-
Network ACL
- Querying Network ACL Rules
- Querying a Network ACL Rule
- Creating a Network ACL Rule
- Updating a Rule
- Deleting a Network ACL Rule
- Querying Network ACL Policies
- Querying a Network ACL Policy
- Creating a Network ACL Policy
- Updating a Network ACL Policy
- Deleting a Network ACL Policy
- Inserting a Network ACL Rule
- Removing a Network ACL Rule
- Querying Network ACL Groups
- Querying a Network ACL Group
- Creating a Network ACL Group
- Updating a Network ACL Group
- Deleting a Network ACL Group
- Security Group
-
Permissions Policies and Supported Actions
- Introduction
- VPC
- Subnet
- EIP
- Bandwidth
- Bandwidth (V2.0)
- EIP V3
- Port
- VPC Peering Connection
- VPC Route
- Route Table
- Quota
- Private IP Address
- Security Group
- Security Group Rule
- Port (OpenStack Neutron API)
- Network (OpenStack Neutron API)
- Subnet (OpenStack Neutron API)
- Router (OpenStack Neutron API)
- Floating IP Address (OpenStack Neutron API)
- Network ACL (OpenStack Neutron API)
- Security Group (OpenStack Neutron API)
- Precautions for API Permissions
- Appendix
- Change History
-
User Guide (ME-Abu Dhabi Region)
- General Reference
Copied.
Using a Third-Party Firewall to Scrub Traffic for VPCs Connected by VPC Peering Connections
Application Scenario
VPC allows you to configure and manage virtual networks. You can use security groups and network ACLs to control network access. You can also use third-party firewalls to ensure the security of cloud services.
This section describes how to use a firewall to scrub traffic across VPCs that are connected using VPC peering connections.
Architecture
In this example, services are deployed in VPC-A, VPC-B, and VPC-C, and the firewall is deployed in VPC-X. These VPCs communicate with each other through VPC peering connections. The traffic across VPC-A, VPC-B, and VPC-C must flow through the firewall in VPC-X. The default route table of VPC-X directs all inbound traffic to the firewall. After being scrubbed by the firewall, the traffic is sent to a service VPC based on the custom route table.
Figure 1 shows how ecs-A01 accesses ecs-C01. You can view the request and response traffic paths.
Resource Planning
In this example, you need to create VPCs, ECSs, and VPC peering connections. For details about required resources, see Table 1.
The following resource planning details are only examples for your reference. You need to plan resources based on actual service requirements.
Resource |
Description |
---|---|
VPC |
Table 2 shows details about the required VPCs. In this example, there are four VPCs, including three VPCs where services are deployed and one VPC where the firewall is deployed. These VPCs are from the same region, and their subnet CIDR blocks do not overlap.
NOTICE:
The subnet CIDR blocks of the VPCs that need to communicate with each other through a VPC peering connection cannot overlap. Otherwise, the VPC peering connection does not take effect. For details, see Unsupported VPC Peering Configurations. |
ECS |
Table 3 shows details about the required ECSs. The four ECSs are in different VPCs. If the ECSs are in different security groups, add rules to the security groups to allow access to each other. |
VPC peering connection |
Table 4 shows details about the required VPC peering connections.
There are three VPC peering connections.
VPC peering connections are transitive. After routes are configured, VPC-A, VPC-B, and VPC-C can communicate with each other through VPC-X. |
VPC Name |
VPC CIDR Block |
Subnet Name |
Subnet CIDR Block |
Route Table |
Subnet Is Used to Deploy |
---|---|---|---|---|---|
VPC-A |
10.1.0.0/16 |
subnet-A01 |
10.1.0.0/24 |
Default route table |
Services |
VPC-B |
10.2.0.0/16 |
subnet-B01 |
10.2.0.0/24 |
Default route table |
Services |
VPC-C |
10.3.0.0/16 |
subnet-C01 |
10.3.0.0/24 |
Default route table |
Services |
VPC-X |
192.168.0.0/16 |
subnet-X01 |
192.168.0.0/24 |
Custom route table |
Firewall |
ECS Name |
VPC Name |
Subnet Name |
Private IP Address |
Image |
Security Group |
ECS Is Used to Deploy |
---|---|---|---|---|---|---|
ecs-A01 |
VPC-A |
subnet-A01 |
10.1.0.139 |
Public image: CentOS 8.2 64bit |
sg-demo: General-purpose web server |
Services |
ecs-B01 |
VPC-B |
subnet-B01 |
10.2.0.93 |
Services |
||
ecs-C01 |
VPC-C |
subnet-C01 |
10.3.0.220 |
Services |
||
ecs-X01 |
VPC-X |
subnet-X01 |
192.168.0.5 |
Firewall |
Route Configuration
You need to add routes to VPC route tables to allow communication between VPCs and scrub traffic through the firewall. For details, see Table 5.
The following routes are only examples for your reference. You need to plan routes based on actual service requirements.
Route Table |
Description |
---|---|
Route tables of service VPCs |
Table 6 shows details about route tables of service VPCs. The default route tables of VPC-A, VPC-B, and VPC-C have routes with destinations set to other VPC subnets and with next hop set to VPC peering connection. |
Route tables of firewall VPC |
Table 7 shows details about route tables of the firewall VPC-X.
|
VPC Name |
Route Table |
Destination |
Next Hop Type |
Next Hop |
Route Type |
Route Function |
---|---|---|---|---|---|---|
VPC-A |
Default route table: rtb-vpc-A |
10.2.0.0/24 |
VPC peering connection |
peer-AX |
Custom |
|
10.3.0.0/24 |
VPC peering connection |
peer-AX |
Custom |
|
||
192.168.0.0/24 |
VPC peering connection |
peer-AX |
Custom |
|
||
VPC-B |
Default route table: rtb-vpc-B |
10.1.0.0/24 |
VPC peering connection |
peer-BX |
Custom |
|
10.3.0.0/24 |
VPC peering connection |
peer-BX |
Custom |
|
||
192.168.0.0/24 |
VPC peering connection |
peer-BX |
Custom |
|
||
VPC-C |
Default route table: rtb-vpc-C |
10.1.0.0/24 |
VPC peering connection |
peer-CX |
Custom |
|
10.2.0.0/24 |
VPC peering connection |
peer-CX |
Custom |
|
||
192.168.0.0/24 |
VPC peering connection |
peer-CX |
Custom |
|
VPC Name |
Route Table |
Destination |
Next Hop Type |
Next Hop |
Route Type |
Route Function |
---|---|---|---|---|---|---|
VPC-X |
Default route table: rtb-vpc-X |
0.0.0.0/0 |
Server |
ECS-X |
Custom |
If your firewall is deployed on multiple ECSs and these ECSs communicate with external networks through a virtual IP address, set the next hop of the route to the virtual IP address. |
Custom route table: rtb-vpc-custom-X |
10.1.0.0/24 |
VPC peering connection |
peer-AX |
Custom |
|
|
10.2.0.0/24 |
VPC peering connection |
peer-BX |
Custom |
|
||
10.3.0.0/24 |
VPC peering connection |
peer-CX |
Custom |
|
Notes and Constraints
- A VPC peering connection can only enable communication between VPCs in the same region.
- The subnet CIDR blocks of the VPCs that need to communicate with each other through a VPC peering connection cannot overlap. Otherwise, the VPC peering connection does not take effect. For details, see Unsupported VPC Peering Configurations.
- The subnet where the ECS deployed with a third-party firewall resides needs to be associated with a custom route table. Ensure that the region where your resources are located supports custom route tables.
If Route Tables is displayed in the left pane of the network console, custom route tables are supported.
Figure 2 Route Tables
Procedure
- Create four VPCs and their subnets in region A.
For details, see Creating a VPC.
For details about VPCs and their subnets, see Table 2.
- Create a custom route table in VPC-X and associate subnet-X01 with the custom route table.
- Create a custom route table in VPC-X.
For details, see Creating a Custom Route Table.
- Associate subnet-X01 with the custom route table created in 2.a.
After subnet-X01 is created, it is automatically associated with the default route table of VPC-X. You need to associate the custom route table created in 2.a to subnet-X01.
For details, see Changing the Route Table Associated with a Subnet.
- Create a custom route table in VPC-X.
- Create an ECS in each VPC.
For details, see Purchasing a Custom ECS.
- Configure the NIC of ecs-X and install the third-party firewall on ecs-X.
- Disable source/destination check for the NIC of ecs-X.
- In the ECS list, click the name of the target ECS.
- On the Network Interfaces tab, click
to expand the details area and check whether Source/Destination Check is disabled.
If the information shown in Figure 3 is displayed, Source/Destination Check is disabled.
- Install a third-party firewall on ecs-X.
- Disable source/destination check for the NIC of ecs-X.
- (Optional) Configure a virtual IP address for ECSs.
You can create two ECSs in VPC-X and bind them to the same virtual IP address so that they can work in the active and standby mode. If the active ECS is faulty and cannot provide services, the virtual IP address will be dynamically switched to the standby ECS to continue providing services. Skip this step if the ECS where the firewall is deployed does not need to work in the active/standby mode.
- Assign a virtual IP address in the VPC-X subnet.
For details, see Assigning a Virtual IP Address.
- Bind the virtual IP address to the active and standby ECSs where the firewall is deployed.
For details, see Binding a Virtual IP Address to an EIP or ECS.
- Assign a virtual IP address in the VPC-X subnet.
- Create three VPC peering connections and configure routes.
- Create three VPC peering connections.
- If your VPCs are in the same account, see Creating a VPC Peering Connection with Another VPC in Your Account.
- If your VPCs are in different accounts, see Creating a VPC Peering Connection with a VPC in Another Account.
For details about VPC peering connections, see Table 4.
- In the default route tables of the three service VPCs, add routes with destination set to the other three VPCs and with next hop set to the VPC peering connection.
For details, see Adding a Custom Route.
In this example, add the routes planned in Table 6 to the route tables of VPC-A, VPC-B, and VPC-C.
- Add routes to the default and custom route tables of the firewall VPC.
For details, see Adding a Custom Route.
In this example, add the routes planned in Table 7 to the default and custom route tables of VPC-X.
- Create three VPC peering connections.
- Log in to the ECS and check whether the firewall takes effect.
For details, see How Do I Log In to My ECS?.
In this example, use VNC provided on the management console to log in to an ECS.
- Log in to ecs-A01 and verify the network connectivity between VPC-A and VPC-B.
ping Private IP address of ecs-B01
Example command:
ping 10.2.0.93
If information similar to the following is displayed, the two VPCs can communicate with each other.
[root@ecs-A01 ~]# ping 10.2.0.93 PING 10.2.0.93 (10.2.0.93) 56(84) bytes of data. 64 bytes from 10.2.0.93: icmp_seq=1 ttl=64 time=0.849 ms 64 bytes from 10.2.0.93: icmp_seq=2 ttl=64 time=0.455 ms 64 bytes from 10.2.0.93: icmp_seq=3 ttl=64 time=0.385 ms 64 bytes from 10.2.0.93: icmp_seq=4 ttl=64 time=0.372 ms ... --- 10.2.0.93 ping statistics ---
- Keep the network connectivity between VPC-A and VPC-B in 7.a and log in to ecs-X01 to verify whether the traffic from VPC-A to VPC-B flows through ecs-X01.
- On ecs-X01, check the traffic change on eth0.
Run the following command at least twice consecutively to check whether the values of RX packets and TX packets change:
ifconfig eth0
If the packets change, the traffic flows through ecs-X01 and is scrubbed by the firewall.[root@ecs-X01 ~]# ifconfig eth0 eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.0.5 netmask 255.255.255.0 broadcast 192.168.0.255 inet6 fe80::f816:3eff:feb6:a632 prefixlen 64 scopeid 0x20<link> ether fa:16:3e:b6:a6:32 txqueuelen 1000 (Ethernet) RX packets 726222 bytes 252738526 (241.0 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 672597 bytes 305616882 (291.4 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [root@ecs-X01 ~]# ifconfig eth0 eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.0.5 netmask 255.255.255.0 broadcast 192.168.0.255 inet6 fe80::f816:3eff:feb6:a632 prefixlen 64 scopeid 0x20<link> ether fa:16:3e:b6:a6:32 txqueuelen 1000 (Ethernet) RX packets 726260 bytes 252748508 (241.0 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 672633 bytes 305631756 (291.4 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
- Repeat 7.a to 7.c to check the communication between other VPCs.
- Log in to ecs-A01 and verify the network connectivity between VPC-A and VPC-B.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot