IPv6 Gateway route IPv6 traffic to and from VPC. By default, IPv6 addresses support only private communication within VPCs. Enable IPv6 Internet bandwidth to allow public Internet access, and configure egress-only rules to restrict traffic to outbound connections only.
Basic concepts
|
Term |
Description |
|
IPv6 address |
Assigned by the system or manually. Example IPv6 address: 2001:db8:1:1:1:1:1:1 The system can also assign IPv6 prefixes (IPv6 CIDR blocks). Example IPv6 prefix: fd02:XXXX:7:f900:6ce2::/80 |
|
IPv6 gateway |
Connects Elastic Compute Service (ECS) instances in VPCs to the Internet over IPv6. Manage IPv6 Internet bandwidth and configure egress-only rules through IPv6 gateways. |
|
IPv6 Internet bandwidth |
Controls whether an IPv6 address can access the Internet. Enable IPv6 Internet bandwidth for an IPv6 address to allow Internet communication. |
|
egress-only rule |
Controls outbound IPv6 traffic through the IPv6 gateway. When configured for an IPv6 address, only outbound Internet traffic is allowed. Inbound requests from the Internet are denied. |
|
IPv6 CIDR block of a VPC |
A /56 IPv6 CIDR block automatically allocated to a VPC when IPv6 is enabled. |
|
IPv6 CIDR block of a vSwitch |
A /64 IPv6 CIDR block allocated to a vSwitch by default. You can customize the last eight bits when enabling IPv6 for the vSwitch. |
Features
IPv6 gateways support the following features:
-
Communication within VPCs
By default, IPv6 Internet bandwidth is 0 Mbit/s. IPv6 addresses are used only for private communication within VPCs. ECS instances with IPv6 addresses can communicate with other IPv6-enabled instances in the same VPC, but cannot access or be accessed from the Internet.
-
Communication over the Internet
-
Purchase IPv6 Internet bandwidth for an IPv6 address to enable both inbound and outbound Internet access over IPv6.
-
Set IPv6 Internet bandwidth to 0 Mbit/s to restrict the address to VPC-only communication.
-
Configure egress-only rules to allow outbound Internet access while denying inbound requests from IPv6 clients.
-
Delete an egress-only rule to restore full bidirectional Internet access for an IPv6 address that has IPv6 Internet bandwidth enabled.
-
The following table describes how network type, Internet bandwidth, and egress-only rules affect IPv6 communication.
|
Network type |
Whether IPv6 Internet bandwidth is enabled |
Whether an egress-only rule is configured |
Communication capability |
|
VPC |
No |
No |
Communication within VPCs |
|
Internet |
Yes |
No |
Communication within VPCs Communication over the Internet |
|
Yes |
Communication within VPCs Internet access only |
Scenarios
Scenario 1: Build an isolated IPv6 network in a VPC
Enable IPv6 for an existing VPC to support dual-stack (IPv4 and IPv6). Assign IPv6 addresses to ECS instances — each instance retains its IPv4 address alongside the new IPv6 address. By default, IPv6 addresses are used only for private communication within the VPC.
-
Dual-stack ECS instances can use IPv4 or IPv6 to communicate with other VPC resources. IPv4 and IPv6 communication are independent.
-
ECS instances cannot use IPv6 addresses to access or be accessed from the Internet.
Scenario 2: Enable Internet access over IPv6
Enable IPv6 Internet bandwidth for ECS instances in a VPC. IPv6 traffic between ECS instances and the Internet passes through the IPv6 gateway, which processes both inbound and outbound traffic.
ECS instances in the VPC can also communicate with IPv4 clients on the Internet through elastic IP addresses, Server Load Balancer (SLB) instances, and NAT gateways.
Scenario 3: Allow outbound-only IPv6 access
Configure an egress-only rule for an ECS instance's IPv6 address to allow outbound access while denying inbound requests.
The ECS instance can access the Internet over IPv6 but cannot be reached by external IPv6 clients.
Benefits
IPv6 gateways provide the following benefits:
-
High availability
Cross-zone high availability for stable IPv6 Internet communication.
-
High performance
A single IPv6 gateway provides 10 Gbit/s throughput for IPv6 Internet traffic.
-
Flexible traffic management
Adjust IPv6 Internet bandwidth and configure egress-only rules to control Internet access.
Regions that support IPv6 gateways
Area | Regions |
Asia Pacific - China | China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Fuzhou - Local Region), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), and China (Hong Kong) |
Asia Pacific - Others | Philippines (Manila), Singapore, Japan (Tokyo), South Korea (Seoul), Indonesia (Jakarta), Malaysia (Kuala Lumpur), and Thailand (Bangkok) |
Europe & Americas | US (Virginia), US (Silicon Valley), Germany (Frankfurt), UK (London), and Mexico |
Middle East | SAU (Riyadh - Partner Region) |
IPv6 access
Manage IPv6 gateways through the following methods:
-
IPv6 Gateway console: a web interface to create, manage, and delete IPv6 gateways. Create and manage IPv6 gateways.
-
Alibaba Cloud SDKs: SDKs for Java, Go, PHP, Python, and other programming languages.
-
OpenAPI Explorer: search and call API operations online, and generate SDK sample code.
-
Terraform: orchestrate and version-control IPv6 gateway resources as infrastructure as code.