By default, a virtual private cloud (VPC) uses the IPv4 addressing protocol. When you create a VPC, you must specify an IPv4 CIDR block. To allow an Elastic Compute Service (ECS) instance in a VPC to communicate with the Internet, you must obtain a public IP address for the instance. You can also enable the IPv6 addressing protocol to assign an IPv6 CIDR block to the VPC. Each IPv6 address is globally unique. You can configure the IPv6 addresses that are assigned to ECS instances as either private or public IP addresses.
Private IP addresses
In most cases, private IP addresses refer to private IPv4 addresses. A private IPv4 address is an IPv4 address that is not reachable over the Internet. You can use private IPv4 addresses for communication between ECS instances and internal resources. Private IPv4 addresses are assigned to instances using the Dynamic Host Configuration Protocol (DHCP). A private IPv4 address that is assigned to an ECS instance must be within the private IPv4 CIDR block of the vSwitch to which the instance is connected. The number of private IPv4 addresses that can be assigned to each elastic network interface (ENI) on an ECS instance varies based on the instance type. For more information, see the Private IPv4 Addresses per ENI metric in Instance families.
Note the following information about private IPv4 addresses:
When you start an ECS instance, the instance obtains a primary private IPv4 address from the vSwitch CIDR block. This address serves as the default private egress IP address. If you do not specify a primary private IPv4 address when you create an ECS instance, Alibaba Cloud automatically assigns an available IP address from the vSwitch's IPv4 CIDR block as the primary private IPv4 address for the instance. The primary private IPv4 address is assigned to the primary ENI of the instance. An instance can have only one primary private IPv4 address. After a primary private IPv4 address is assigned, it cannot be reclaimed before the instance is released. If you want to change the primary private IPv4 address of an instance, see Modify a private IP address.
You can automatically or manually assign additional private IPv4 addresses to an instance. These addresses are called secondary private IPv4 addresses. You can reclaim and reassign secondary private IPv4 addresses before the instance is released. However, you cannot modify them after they are assigned. After you assign a secondary private IPv4 address, you must manually configure it. For more information, see Secondary private IP addresses.
Private IPv4 addresses are retained when you stop and start an ECS instance. They are reclaimed when the instance is released.
Public IP addresses
Public IP addresses usually refer to public IPv4 addresses. You can use public IPv4 addresses to enable communication between ECS instances and the Internet. To access the Internet using a public IPv4 address, you must purchase public bandwidth for the instance.
ECS instances in a VPC support static public IP addresses and elastic IP addresses (EIPs).
When you start an ECS instance, you can manually configure public bandwidth. Alibaba Cloud then selects a public IPv4 address from the public IP address pool and assigns it to the ECS instance. By default, Alibaba Cloud does not automatically assign a public IP address to an instance.
For an existing instance that does not have a public IP address, you can change its configuration. If you increase the peak bandwidth to a value greater than 0 Mbit/s, a public IPv4 address is automatically assigned to the instance.
A public IP address is reclaimed when the instance is released and cannot be retained. In the following cases, the public IP address of an ECS instance is reclaimed or reassigned:
If you set the bandwidth of your instance to 0 Mbit/s while it is in use, the public IP address is reclaimed. For information about how to modify the bandwidth for instances that use different billing methods, see Modify the bandwidth of a subscription instance with a static public IP address and Modify the bandwidth of a pay-as-you-go instance.
If you stop a pay-as-you-go instance in economical mode, its public IP address is released. When you restart the ECS instance, the system reassigns a public IP address to your instance. Alibaba Cloud cannot guarantee that the same public IP address is reassigned to your ECS instance.
If you want to use a public IPv4 address for a long time and repeatedly assign it to different ECS instances, you can convert the public IP address to an EIP. For more information, see Convert a static public IP address to an EIP.
An EIP is a public IP address resource that you can purchase and hold independently. You can request an EIP separately or convert it from a public IP address. You can associate EIPs with and disassociate them from ECS instances. An ECS instance can be associated with multiple EIPs. For more information, see Associate an EIP with a secondary ENI. An EIP is not reclaimed when the ECS instance is released. If you want to release an EIP, see Release a pay-as-you-go EIP. For more information about how to use EIPs, see EIP overview.
IPv6 addresses
Alibaba Cloud VPC supports IPv6 addresses. After you enable the IPv6 addressing protocol, Alibaba Cloud assigns IPv6 CIDR blocks from the IPv6 address pool to VPCs. You cannot specify IPv6 CIDR blocks for VPCs. vSwitches created in a VPC that supports IPv6 addresses also support IPv6 CIDR blocks. You can enable an IPv6 CIDR block when you create a vSwitch or for an existing vSwitch. For more information, see Create and manage vSwitches. An IPv6 address that is assigned to an instance must be within the IPv6 CIDR block of the vSwitch to which the instance is connected. The number of IPv6 addresses that can be assigned to each ENI on an instance varies based on the instance type. For more information, see the IPv6 addresses per ENI metric in Instance families.
IPv6 addresses are globally unique. By default, IPv6 addresses assigned to ECS instances support only private access. To use an IPv6 address to access the Internet or be accessed from the Internet, you must enable IPv6 Internet bandwidth.
You can assign multiple IPv6 addresses to the primary ENI of an ECS instance when you create the instance.
After you create an ECS instance, you can assign one or more IPv6 addresses to the ENIs that are attached to the instance.
After you assign an IPv6 address, log on to the instance to configure the IPv6 address in the operating system for the address to take effect.
You can unassign and reassign IPv6 addresses before the instance is released. IPv6 addresses are retained when you stop and start the ECS instance. They are released when the ENI is released.
View the IP addresses of an instance
You can view the IP addresses of an instance in the ECS console or by logging on to the instance. Make sure that the IP address information is consistent in both places. If the IP address information on the instance is inconsistent with the assigned IP address information, issues such as public and private network communication failures, invalid security group rules, and management difficulties may occur.
View in the console
Log on to the ECS console.
In the left-side navigation pane, choose .
In the top navigation bar, select the region and resource group of the resource that you want to manage.
On the Instance page, find the destination instance and click the instance ID to go to the Instance Details page. You can then view the required IP addresses.
In the Configuration Information section:
Public IP Address: 47.98.XX.XX
Elastic IP Address: 121.41.XX.XX
Primary Private IP Address: 192.168.XX.XX
In the Associated Resources section:
Secondary Private IP Address: 192.168.XX.XX,192.168.XX.XX
IPv6 Address: 2408:XXXX:325:a216:95f1:3dd9:6640:8b9e
NoteIf your instance is not assigned a static public IP address, a secondary private IP address, or an IPv6 address, or is not associated with an EIP, the related fields are empty.
View API
You can call the DescribeInstanceAttribute operation to query the IP address information of a specified instance:
PrivateIpAddress: The primary private IPv4 address of the instance.
PublicIpAddress: The static public IP address of the instance.
EipAddress: The EIP that is associated with the instance.
You can also call the DescribeNetworkInterfaceAttribute operation to query information about an ENI, such as its secondary private IP addresses, IPv6 addresses, and EIPs.
View IP addresses from within an instance
Linux instances: After you remotely connect to a Linux instance, you can run the
ip acommand to view the private IP addresses of the instance.
You can also run the
sudo route -ncommand to view the gateway IP address:In the row where the value in the
Destinationcolumn is the default route (0.0.0.0), the IP address in theGatewaycolumn is the internal gateway IP address of theeth0network device.
Windows instances: After you remotely connect to a Windows instance, you can run the
ipconfigcommand to view information such as the private IP address and default gateway of the instance.
In a VPC, the public IP address exists on the gateway device. Therefore, the public IP address is not visible in the operating system of an ECS instance in the VPC. You can view only the private IP address. If your application requires a public IP address that is visible in the operating system, see Make an EIP visible on an ENI using a secondary CIDR block.
References
If a client cannot ping the public IP address of a destination ECS instance, see Troubleshoot issues when you cannot ping the public IP address of an ECS instance.
An IPv6 address may be inaccessible due to internal configuration errors or a lack of Internet access. For more information, see Troubleshoot issues when you cannot ping the IPv6 address of an ECS instance.
In a multi-instance cluster scenario, if you cannot assign a public IP address to each ECS instance, see Use the SNAT feature of an Internet NAT gateway to enable an ECS instance without a public IP address to access the Internet.
When you create a VPC and vSwitch, you must specify the VPC and vSwitch CIDR block. The size of the CIDR block determines the amount of resources that can be deployed. Proper CIDR block planning avoids address conflicts and ensures scalability, whereas improper planning may cause high costs for network reconstruction.
For more information, see Network planning.
ECS instances in the same VPC can communicate with each other over the internal network. You can use security groups to control access. When you need to establish secure and efficient private communication between resources in different VPCs, you can use cross-VPC interconnection solutions such as Cloud Enterprise Network (CEN), VPC peering connections, or PrivateLink. For more information, see ECS service interconnection.