In the VPC network, you can use an Elastic IP Address (EIP), a NAT Gateway, an Internet Server Load Balancer (SLB) instance, or the public IP address of an ECS instance to access the Internet.
Public IP address
In Alibaba Cloud, there are various types of public IP addresses, such as the public IP address of an ECS instance, the public IP address of a NAT bandwidth package, the public IP address of an Internet SLB instance, and the public IP address of a VPN Gateway. To facilitate the management of public IP addresses, ECS instances of the VPC network, NAT Gateways, and intranet SLB instances can all be associated with EIPs.
You can add EIPs to an Internet Shared Bandwidth instance or a Data Transfer Plan to flexibly cope with traffic and bandwidth fluctuations and reduce the Internet cost.
Products with access to the Internet
The following table lists the features of Alibaba Cloud products that have access to the Internet.
Apart from the following products, Alibaba Cloud provides Internet Shared Bandwidth and Data Transfer Plan for VPCs to help you reduce the cost of Internet bandwidth and traffic. You can select a suitable product based on your service needs to reduce costs.
|ECS public IP address||When you create an Elastic Compute Service (ECS) instance in a VPC network, you can allow the system to automatically assign a public IP address to the ECS instance. Then, the ECS instance can use the public IP address to communicate with the Internet.
You cannot unbind a public IP address from an ECS instance when the ECS instance is running. However, you can convert the public IP address to an elastic IP address (EIP). For more information, see Convert an automatically assigned public IP address to an EIP for a VPC-connected ECS instance.
You can purchase data transfer plans for an ECS instance that is assigned public IP addresses. You can also purchase EIP bandwidth plans for an ECS instance after you convert the public IP address of the ECS instance to an EIP. For more information, see What is EIP bandwidth plan and What is a data transfer plan.
|Elastic IP Address||EIPs can be associated with or disassociated from ECS instances anytime. ECS instances can use EIPs to communicate with the Internet based on Source Network Address Translation (SNAT) and Destination Network Address Translation (DNAT).||
EIPs can be associated with or disassociated from ECS instances anytime.
You can use EIP bandwidth plans and data transfer plans to reduce the costs of data transfer over the Internet.
|NAT Gateway||You can create SNAT and DNAT entries on a NAT gateway to enable one or more ECS instances in a VPC network to communicate with the Internet.
Note Unlike Server Load Balancer (SLB), NAT gateways are incapable of balancing the load of ECS instances.
|A NAT gateway can provide Internet access for more than one ECS instance while an EIP can serve only one ECS instance.|
|Server Load Balancer||
Server Load Balancer (SLB) is a port-based service that provides Layer-4 and Layer-7 load balancing. ECS instances that are connected to SLB can be accessed over the Internet.
Note SLB does not support SNAT. ECS instances deployed in VPC networks cannot access the Internet through SLB.
|SLB supports DNAT. Each port on an SLB instance can be mapped to one or more ECS instances.
SLB distributes traffic to ECS instances to balance the load of the ECS instances. This improves the availability of application systems and eliminates single points of failure.
After you associate an EIP with an SLB instance, you can purchase EIP bandwidth plans and data transfer plans to reduce costs.
Scenario 1: Provide external services
Provide external services by using a single ECS instance
If you have only one application with relatively low traffic, a single ECS instance can meet your requirements. You can deploy applications, databases, and files on this ECS instance. Then, associate an EIP to the ECS instance. In this way, users can access your application through the Internet.
Provide external services by using the Layer-4 load balancing function
If the traffic is high and one ECS instance cannot handle all access traffic, you can configure multiple ECS instances and a simple load balancing function. Specifically, you can create an Internet SLB instance with a Layer-4 listener and add the ECS instances as backend servers.
Provide external services by using the Layer-7 load balancing function
If you want to distribute different requests to different backend servers, you can add domain name-based or URL-based forwarding rules to a Layer-7 listener. Specifically, you can create an Internet SLB instance with a Layer-7 listener and add the ECS instances as backend servers.
Scenario 2: Internet access of an ECS instance without a public IP address
Associate an EIP
If the number of ECS instances is relatively small, you can associate an EIP with each ECS instance. The ECS instance then can access the Internet by using the EIP. You can also disassociate the EIP from the ECS instance when Internet access is no longer needed.
Use NAT Gateway and configure SNAT entries
If the number of ECS instances is large, associating an EIP with each ECS instance incurs high costs. Also, users accessing ECS instances through the EIPs poses some risks. In this case, we recommend that you configure an SNAT entry for the ECS instances, but do not configure any DNAT entries. In this way, the ECS instances can access the Internet, but users cannot access these ECS instances over the Internet, as shown in the following figure.