NAT Gateway:Use a VPC NAT gateway to resolve address conflicts

Why overlapping CIDR blocks block communication

When ECS instances in two VPCs with overlapping CIDR blocks try to communicate, routing fails in one of two ways:

• VPC CIDR as destination — Traffic matches the local system route first and stays inside the originating VPC. It never reaches the peer VPC.

• vSwitch CIDR as destination — You cannot add a custom route whose destination CIDR block is the same as or more specific than an existing system route.

Solution overview

The solution separates address spaces into two categories:

• Overlapping (non-routable) ranges — The existing VPC CIDR blocks that conflict. Traffic cannot be routed directly between VPCs using these addresses.

• Non-overlapping (routable) ranges — Secondary CIDR blocks you add to each VPC. These conflict-free ranges serve as the routable address space for NAT gateways and transit routing.

Three components work together to resolve the conflict:

1. Secondary CIDR blocks — Add non-overlapping secondary CIDR blocks to both VPCs. NAT gateways live in these ranges and use them as translation addresses.

2. VPC NAT gateways — Deploy one VPC NAT gateway per VPC, each in a vSwitch belonging to the secondary CIDR block. Source Network Address Translation (SNAT) rules translate outbound source IPs; Destination Network Address Translation (DNAT) rules translate inbound destination IPs.

3. Transit router — Attach both VPCs to a Cloud Enterprise Network (CEN) transit router to enable private connectivity between the two secondary CIDR blocks.

Address mapping

The table below shows how addresses are translated at each hop. All post-translation addresses come from the non-overlapping secondary CIDR blocks.

Traffic path

The following example traces a request from ECS_A (private IP: 192.168.0.86) to ECS_B, accessed at the NAT IP address 10.0.0.53.

1. ECS_A sends a packet. The custom route table bound to its vSwitch forwards the packet to VPC_NATGW_A.

2. The SNAT rule on VPC_NATGW_A replaces the source IP with the NAT IP address 172.16.0.89.

3. The system route table in VPC_A forwards the packet to the transit router (TR). TR delivers it to VPC_B, then to VPC_NATGW_B.

4. The DNAT rule on VPC_NATGW_B translates the destination IP to ECS_B's private IP. Traffic reaches ECS_B.

On the return path, the session mapping table reverts the original private IP address. Then routing delivers the packet to ECS_A.

Create VPC NAT gateways

Open the VPC NAT gateway purchase page and create a gateway for each VPC:

Configure SNAT entries

SNAT rules translate the source IP of outbound packets to the NAT IP address, making traffic from VPC_A appear to originate from the secondary CIDR block.

1. Open the VPC NAT gateway list page and select the region where your VPC NAT gateways reside.

2. In the SNAT Management column of VPC_NATGW_A, click Actions > Create SNAT Entry and set the following:

   Field	Value
   SNAT Entry	Specify VPC
   Select NAT IP Address	The private IP of VPC_NATGW_A

Configure DNAT entries

DNAT rules translate the destination IP of inbound packets, mapping the NAT IP address to a specific ECS instance inside VPC_B.

1. On the VPC NAT gateway list page, click DNAT Management in the Actions column of VPC_NATGW_B. Click Create DNAT Entry and set the following:

   Field	Value
   Select NAT IP Address	The private IP of VPC_NATGW_B
   Select Private IP Address	The ECS instance in VPC_B that needs to be accessed
   Port Settings	Specific Port: frontend port 22, backend port 22, Protocol TCP

Adjust the DNAT entry to match your service's protocol and port.

Create CEN connections

1. Open the Cloud Enterprise Network (CEN) Management Console and click Create CEN Instance. Select Create CEN Only, then click OK.

2. After the CEN instance is created, click Create Connection > Intra-region and set the following for VPC_A:

   Field	Value
   Network Type	Virtual private cloud (VPC)
   Region	The region where the VPC resides
   Resource Owner ID	Your Account
   Networks	VPC_A
   vSwitch	Select at least two zones. Include the vSwitch where VPC_NATGW_A is located.
   Advanced Settings	Select all

3. Click Continue To Create Connection and repeat the same configuration for VPC_B.

Configure route tables

A VPC NAT gateway handles address translation only — it does not control traffic flow. Route tables determine whether traffic reaches the NAT gateway and where it goes after translation.

Create custom route tables and bind them to vSwitches:

1. Open the Route Tables page and select your region.

2. Click Create Route Table for each VPC:

   Field	Value
   VPC	VPC_A (repeat for VPC_B)
   Associated Resource Type	vSwitch

3. In the Associated Resource column of the new route table, click Bind and select the vSwitch that contains the ECS instance.

Add route entries:

Click the route table ID, open the Custom Route tab, click Add Route Entry, and configure routes according to the following table:

The custom route table entries direct traffic from ECS instances to the VPC NAT gateway first (for address translation). The system route table entries then forward the translated traffic through the transit router to the peer VPC.