Agent Sandbox:Configure a fixed public IP for a sandbox instance

Scenarios and network path

This solution applies to scenarios that require a fixed egress IP address for a sandbox instance. One example is when the egress IP address must be added to the access control whitelist of an external service. Internet traffic is forwarded along the following path:

Sandbox instance → VPC/vSwitch → route table (0.0.0.0/0) → Internet NAT gateway (SNAT) → EIP → Internet

Create an Internet NAT gateway and associate an EIP

An Internet NAT gateway must be associated with an EIP to work. Before you create one, confirm the following items:

• EIP quota: An Internet NAT gateway supports up to 20 EIPs. If the quota is insufficient, go to Quota Center to increase the quota.

• Available private IP addresses: The vSwitch that hosts the Internet NAT gateway must have sufficient available private IP addresses. Otherwise, the EIP cannot be associated.

Starting September 19, 2022, associating an EIP with a newly created Internet NAT gateway consumes one private IP address from the vSwitch that hosts the gateway. Existing Internet NAT gateway instances are not affected.

1. Go to the Internet NAT Gateway purchase page , and then switch to the region where the sandbox instance resides.

2. Configure the following parameters:

   • Billing Method: Select Pay-As-You-Go.

   • Region: Select the region in which to create the Internet NAT gateway. The region must be the same as the region of the sandbox instance.

   • Network and Zone: Select the Virtual Private Cloud (VPC) and vSwitch for the Internet NAT gateway. The vSwitch that you select here assigns a private IP address to the Internet NAT gateway, and associating an EIP consumes one private IP address from this vSwitch. After the Internet NAT gateway is created, the vSwitch that you select here cannot be changed.

   • Disaster Recovery: Select the disaster recovery mode for the Internet NAT gateway.

     • Cross-zone disaster recovery (default): Deploys the gateway in a primary zone and a secondary zone. If the primary zone fails, traffic automatically fails over to the secondary zone. This mode applies to scenarios that require high Internet egress continuity.

     • Single-zone disaster recovery: Deploys the gateway only within the selected zone, and ensures high availability through device-level redundancy. This mode applies to scenarios that prioritize cost and can tolerate single-zone deployment. The instance fee for single-zone disaster recovery is 50% of the cross-zone fee, and the capacity unit (CU) fee is 80%.

   • EIP: Select an option based on whether an EIP already exists.

     • Select EIP: Select an EIP that is not associated with an instance.

     • Purchase EIP: Select this option if no EIP is available. By default, a pay-by-traffic BGP (Multi-ISP) EIP is created. The value range and upper limit of the peak bandwidth are subject to the values displayed on the purchase page.

     • Configure Later: The Internet NAT gateway is created without Internet access capabilities, and you must manually associate an EIP later. After the Internet NAT gateway is created, find the target Internet NAT gateway instance and click Associate Now in the EIP column.

To associate a BGP (Multi-ISP)_Premium EIP or an EIP that uses another billing method, apply for the EIP first, and then select Select EIP when you create the Internet NAT gateway.

Configure SNAT entries

An SNAT entry determines which instances access the Internet through the Internet NAT gateway and which EIP is used as the egress IP address.

1. Go to the Internet NAT Gateway page, and then switch to the region where the sandbox instance resides.

2. In the Actions column of the target Internet NAT gateway instance, click Configure SNAT .

3. Click Create SNAT Entry and configure the following parameters:

   • SNAT Entry: Select the scope in which the SNAT entry takes effect. The granularity determines the range of instances that share the same egress IP address. Select the smallest granularity that covers the target sandbox instance to prevent other instances from sharing the egress IP address.

     • VPC Granularity: All sandbox instances in the VPC can access the Internet through this SNAT entry. This granularity has the largest scope.

     • Specify vSwitch: All sandbox instances in the selected vSwitch can access the Internet through the Internet NAT gateway by using this SNAT entry.

     • Specify ECS Instance/ENI: Only the specified Elastic Compute Service (ECS) instances or elastic network interfaces (ENIs) can access the Internet through this SNAT entry.

     • Specify Custom CIDR Block: Resources within the specified CIDR block can access the Internet through this SNAT entry.

   • Select EIP: Select the EIP that provides Internet access from the drop-down list.

     • If no EIP is available, click Purchase and Associate EIP in the drop-down list.

     • Multiple EIPs are supported, and a hash algorithm distributes service connections across them. To prevent uneven traffic from causing a single EIP to reach its bandwidth limit, add each EIP to the same Internet Shared Bandwidth instance.

   • EIP Affinity: If you select multiple EIPs and EIP affinity is disabled, the same private IP address may use different EIPs to access a single destination IP address. After you enable EIP affinity, the same EIP is always used. Because too many concurrent connections to a single destination IP address can cause port allocation to fail when EIP affinity is enabled, continuously monitor the Port allocation failures metric.

An Internet NAT gateway supports separate SNAT entries for multiple vSwitches in the same VPC. The vSwitch that you select here determines the scope of the SNAT entry and is unrelated to the vSwitch that you select when you create the Internet NAT gateway. After the SNAT entry is created, click Edit in the Actions column of the target SNAT entry to modify the EIP and EIP affinity settings.

Configure routes

Route entries ensure that traffic from the sandbox instance to the Internet is forwarded to the Internet NAT gateway. The configuration varies based on the type of route table associated with the vSwitch.

1. Go to the Route Tables page of the VPC console, and then switch to the region where the sandbox instance resides.

2. Find the route table associated with the vSwitch of the sandbox instance, and confirm whether it is a system route table or a custom route table.

3. On the route table details page, click the Custom Route tab, and then perform the operations based on the route table type:

   • The vSwitch is associated with a system route table:

     • If no 0.0.0.0/0 route entry exists in the system route table, the system adds one automatically when you create the first Internet NAT gateway in the VPC. The added entry points to that gateway. No manual action is required.

     • If no 0.0.0.0/0 route entry exists in the system route table but another Internet NAT gateway already exists in the VPC, the system does not automatically configure a route entry. Manually add a route entry in the same way as for a vSwitch associated with a custom route table.

     • If a 0.0.0.0/0 route entry already exists in the system route table, find the entry, click Edit, set Next Hop Type to NAT Gateway, and then select the target Internet NAT gateway instance. After the configuration, all vSwitches in the VPC associated with this system route table can access the Internet through the Internet NAT gateway.

   • The vSwitch is associated with a custom route table: Click Add Route Entry, set Destination CIDR Block to 0.0.0.0/0, set Next Hop Type to NAT Gateway, and then select the target Internet NAT gateway instance. After the configuration, only the vSwitches associated with this route table can access the Internet through the Internet NAT gateway.

Verify network connectivity

Before you verify, make sure that the security group of the sandbox instance allows outbound traffic to the Internet. Otherwise, the following commands cannot reach the Internet. Log on to the sandbox instance, and then verify Internet connectivity and the fixed egress IP address:

# Test whether the instance can access the Internet.
ping www.aliyun.com
# View the current egress public IP address, which should be the EIP associated with the Internet NAT gateway.
curl ifconfig.me

If the ping command returns normal responses, and curl ifconfig.me returns the EIP associated with the gateway, the sandbox instance accesses the Internet through the fixed egress IP address. ifconfig.me is a third-party service. If the command returns no response, first determine whether the service is unreachable or the network is misconfigured.

If the verification fails, troubleshoot the following four items in order:

• Security group: Make sure that the security group of the sandbox instance allows outbound traffic to the Internet.

• Route entry: Make sure that the route table associated with the vSwitch of the sandbox instance contains a 0.0.0.0/0 entry, and that Next Hop Type is NAT Gateway and points to the target Internet NAT gateway instance.

• SNAT entry: Make sure that the scope of the SNAT entry covers the target sandbox instance, and that an EIP that provides Internet access is associated with the entry.

• EIP association: Make sure that the Internet NAT gateway is associated with an EIP. If you selected Configure Later when you created the gateway, complete the manual association.