Why Does an ECS Have EIP Access Information After I Enable a VPN?

This occurs because the ECS has an EIP bound before the VPN is used. That is, you can access the ECS through the VPN or the EIP.

After the VPN is established, traffic from servers meeting ACL rules can enter the tunnel to access ECSs.

• If an EIP is bound to an ECS, devices on a non-VPN network can access the ECS using the EIP.
• If the ECS can be accessed only through a VPN, unbind the EIP from the ECS after the VPN connection is active. When an ECS needs an EIP, you can use ACL rules to specify the traffic that can access the ECS through the EIP.

Retaining an EIP or not depends on your services. If an ECS is used to access an on-premises data center through a VPN, and is also used to provide services accessible from the Internet, its EIP needs to be retained.