All Products
Search

This Product

    File Storage NAS:Access a NAS file system from a data center through VPN Gateway

    Document Center

    File Storage NAS:Access a NAS file system from a data center through VPN Gateway

    Last Updated:Jun 03, 2026

    VPN Gateway provides a secure and stable private connection between your data center and Alibaba Cloud. Use a VPN to mount a NAS file system on an on-premises server or on an ECS instance in a different region without exposing traffic to the public internet.

    Use cases

    VPN Gateway connects your data center to a VPC and connects VPCs across regions. You can mount a file system in the following ways:

    Mount a file system on an on-premises server

    1. Create a file system and a mount target.

      1. Log on to the NAS console.

      2. Create a file system. Create a General-purpose NAS file system using the console.

      3. Create a mount target in the VPC. For more information, see Create a mount target.

    2. Establish a connection between the VPC and your data center. Establish a connection between a VPC and a data center.

    3. Verify that on-premises servers can connect to ECS instances or mount targets in the VPC.

      Log on to an ECS instance in the VPC that has no public IP address. Run the ping command to ping the private IP address of a server in your data center.

    4. After verification, mount the VPC file system on the on-premises server. Mount a file system.

    Mount a file system on an ECS instance across regions

    Mount a file system across regions when one VPN gateway is deployed

    The following example uses two VPCs (VPC1 and VPC2) in different regions.

    1. Create a file system and a mount target.

      1. Log on to the NAS console.

      2. Create a file system. Create a General-purpose NAS file system using the console.

      3. Create a mount target in a VPC. For more information, see Create a mount target.

        The mount target is created in VPC1.

    2. In VPC2, set up a VPN gateway on an ECS instance to serve as the customer gateway.

      Note

    3. Establish a connection between the VPN gateways in VPC1 and VPC2.

      1. Log on to the VPC console.

      2. Create a VPN connection between the VPN gateways in VPC1 and VPC2 (the customer gateways that you created in Step 2). Create an IPsec-VPN connection.

    4. Add a route to the route table of VPC2. Configure routes for a VPN gateway.

      Set Destination CIDR Block to the private CIDR block of VPC1, and set Next Hop to the ECS instance in VPC2 that is acting as the VPN gateway.

    5. Verify connectivity between ECS instances or mount targets in VPC1 and VPC2.

      Log on to an ECS instance in VPC1 and ping the IP address of an ECS instance in VPC2.

    6. After verification, mount the VPC1 file system on the ECS instances in VPC2. Mount a file system.

    Mount a file system across regions when no VPN gateway is deployed

    The following example uses two VPCs (VPC1 and VPC2) in different regions.

    1. Create a file system and a mount target.

      1. Log on to the NAS console.

      2. Create a file system. Create a General-purpose NAS file system using the console.

      3. Create a mount target in a VPC. For more information, see Create a mount target.

        The mount target is created in VPC1.

    2. Establish a connection between the VPN gateways in VPC1 and VPC2.

      1. Log on to the VPC console.

      2. Create VPN gateways in VPC1 and VPC2. Create a VPN gateway.

      3. Create customer gateways in VPC1 and VPC2. Create a customer gateway.

        IP Address refers to the IP addresses of the VPN gateways in VPC1 and VPC2.

      4. Add routes to the route tables of VPC1 and VPC2. Configure routes for a VPN gateway.

        • When adding a route for the VPN Gateway in VPC1, set Destination CIDR Block to the private CIDR block of VPC2, and set Next Hop to the customer gateway in VPC1.

        • When adding a route for the VPN Gateway in VPC 2, set the Destination CIDR Block to the private CIDR block of VPC 1 and the Next Hop to the customer gateway in VPC 2.

    3. Verify connectivity between ECS instances or mount targets in VPC1 and VPC2.

      Log on to an ECS instance in VPC1 and ping the IP address of an ECS instance in VPC2.

    4. After verification, mount the VPC1 file system on the ECS instances in VPC2. Mount a file system.