All Products
Search

This Product

    NAT Gateway:Private network access via NAT and VPN Gateways

    Document Center

    NAT Gateway:Private network access via NAT and VPN Gateways

    Last Updated:Jun 21, 2026

    Use a VPC NAT gateway with a VPN gateway to enable communication between a Virtual Private Cloud (VPC) and an on-premises data center via specified private IP addresses.

    Scenario

    This topic describes the scenario shown in the following figure. An enterprise has a VPC named VPC1 in the China (Qingdao) region and an on-premises data center in the China (Beijing) region. The enterprise needs VPC1 to be able to access the on-premises data center using specific private IP addresses, and vice versa.

    The enterprise plans to use a VPC NAT Gateway with a VPN Gateway to meet this requirement.

    You can use an IPsec connection on a VPN Gateway to establish a secure connection between the on-premises data center and the VPC. The SNAT and DNAT features of a VPC NAT Gateway enable communication between specific IP addresses in the VPC and the on-premises data center. The following table lists the network plan for this example. You can also plan your own CIDR blocks. Make sure that they do not overlap.

    Parameter

    Address block

    CIDR block of VPC1

    10.0.0.0/16

    CIDR blocks of the VSwitches

    • VSW1: 10.0.0.0/24 (China (Qingdao) Zone B)

    • VSW2: 10.0.1.0/24 (China (Qingdao) Zone E)

    IP address of the ECS instance

    ECS1: 10.0.0.81

    CIDR block of the on-premises data center

    172.16.0.0/12

    IP address of the on-premises server

    172.16.0.124

    IP address of the on-premises gateway device

    211.68.XX.XX

    Prerequisites

    • You have created a VPC named VPC1 in the China (Qingdao) region, with two vSwitches: VSW1 in Zone B and VSW2 in Zone E. For more information, see Create and manage a VPC.

    • You have created an ECS instance named ECS1 in VSW1 and deployed applications on it. For more information, see Create an instance by using the wizard.

    Configuration steps

    配置流程

    Step 1: Configure IPsec-VPN

    Use IPsec-VPN to establish a VPN connection between a VPC and an on-premises IDC. To use IPsec-VPN, you must create a VPN Gateway, a customer gateway, and an IPsec connection. For more information, see Quick start for traditional VPN gateways.

    1. Log on to the VPN Gateway console.

    2. Create a VPN Gateway.

      1. On the VPN Gateways page, click Create VPN Gateway.

      2. On the purchase page, set the following parameters, click Buy Now, and complete the payment.

        Parameter

        Description

        Instance Name

        Enter a name for the VPN Gateway instance.

        Region

        Select the region for the VPN Gateway instance. In this example, select China (Qingdao).

        Gateway type

        Keep the default value Standard.

        VPC

        Select the VPC to connect. In this example, select VPC1.

        VSwitch

        Select a VSwitch from the VPC. In this example, select VSW1.

        VSwitch 2

        Select a VSwitch from the VPC. In this example, select VSW2.

        Peak bandwidth

        Select the peak bandwidth for the VPN Gateway. The unit is Mbps.

        In this example, select 5 Mbps.

        Traffic

        By default, VPN gateways are billed by data transfer. For more information, see Billing.

        IPsec-VPN

        Select whether to enable IPsec-VPN. In this example, select Enable.

        SSL-VPN

        Select whether to enable SSL-VPN. In this example, select Disable.

        Duration

        By default, the VPN Gateway is billed hourly.

      3. Return to the VPN Gateways page to view the VPN Gateway instance that you created.

        The new instance is initially in the Preparing state. After 1 to 5 minutes, it transitions to Normal. The Active state means the instance is initialized and ready to use.

    3. Create a customer gateway.

      1. In the navigation pane on the left, choose Interconnections > VPN > Customer Gateways.

      2. In the top navigation bar, select the region for the customer gateway. In this example, select China (Qingdao).

      3. On the Customer Gateway page, click Create Customer Gateway.

      4. In the Create Customer Gateway pane, set the following parameters and click OK.

        Parameter

        Description

        Name

        Enter a name for the customer gateway.

        IP Address

        Enter the public IP address of the gateway device in your on-premises IDC. In this example, enter 211.68.XX.XX.

        ASN

        Enter the Autonomous System Number (ASN) of your on-premises gateway device.

        Description

        Enter a description for the customer gateway.

        For more information about the parameters, see customer gateways.

    4. Create an IPsec connection.

      1. In the navigation pane on the left, go to Interconnections > VPN > IPsec Connections.

      2. In the top navigation bar, select the region for the IPsec connection. In this example, select China (Qingdao).

      3. On the IPsec-VPN connection page, click Create IPsec-VPN Connection.

      4. On the Create IPsec-VPN Connection page, configure the following parameters and click OK.

        Parameter

        Description

        Name

        Enter a name for the IPsec connection.

        Associate Resource

        Select VPN Gateways.

        VPN Gateways

        Select the VPN Gateway you created.

        Routing Mode

        Select a routing mode. In this example, select Destination Routing Mode.

        Effective Immediately

        Determines when the connection is established.

        • Yes. Start negotiations after the configuration is completed.

        • No. Start negotiations when inbound traffic is detected.

        In this example, the default setting is used.

        Tunnel 1 > Customer Gateways

        Select the customer gateway to associate.

        Tunnel 2 > Customer Gateways

        Select the customer gateway to associate.

        Pre-Shared Key

        Enter a pre-shared key. This key must match the pre-shared key configured on your on-premises gateway device. If you leave this blank, the system generates a random 16-character string.

    Step 2: Apply VPN configuration to the on-premises gateway

    After you configure the VPN Gateway, you must also apply the VPN configuration to your on--premises gateway device.

    1. In the left navigation pane, choose Interconnections > VPN > IPsec Connections.

    2. On the IPsec Connections page, find the target IPsec connection and click Generate Peer Configuration in the Actions column.

    3. Apply the downloaded configuration to your on-premises gateway device. For more information, see Configure local gateways.

    Step 3: Create a VPC NAT gateway

    1. Log on to the NAT Gateway console.

    2. In the left-side navigation pane, choose NAT Gateway > VPC NAT Gateway.

    3. On the VPC NAT Gateway page, click Create VPC NAT Gateway.

    4. On the NAT Gateway page, configure the following parameters and then click Buy Now.

      Parameter

      Description

      Region

      Select the region where you want to create the VPC NAT gateway instance. This example uses China (Qingdao).

      VPC

      Select the VPC for the VPC NAT gateway instance. You cannot change the VPC after you create the instance. This example uses VPC1.

      Zone

      Select the availability zone for the VPC NAT gateway instance. In this example, select the availability zone that contains VSW2.

      vSwitch

      Select the vSwitch for the VPC NAT gateway instance. We recommend that you select a dedicated vSwitch. This example uses VSW2.

      Instance Name

      Enter a name for the VPC NAT gateway instance.

      Service-linked Role

      If this is the first time you use a NAT gateway (including an Internet NAT gateway and a VPC NAT gateway), you must click Create Service-Linked Role to create the role.

    5. Return to the VPC NAT Gateway page to view the new instance.

      1. Click the instance ID of the VPC NAT gateway. On the Basic Information tab, view information such as its VPC and vSwitch.

      2. Click the NAT IP tab to view the default NAT IP address range and the default NAT IP address.

      Note

      The default NAT IP address range is the CIDR block of the VPC NAT gateway's vSwitch. The default NAT IP address is a random IP address from the vSwitch's CIDR block. You cannot delete the default NAT IP address range or the default NAT IP address.

    Step 4: Add a route entry

    Add a route entry to the system route table of VPC1 that points to the VPC NAT gateway.

    1. Log on to the VPC console.

    2. On the VPC page, click the ID of VPC1.

    3. On the details page of the VPC, click the Resource Management tab and then click the link under Route Tables.

    4. On the Route Tables page, find the route table for which Route Table Type is System and click its ID.

    5. On the route table details page, choose Route Entry List > Custom Route, and then click Add Route Entry.

    6. In the Add Route Entry panel, set the following parameters and click OK.

      Parameter

      Description

      Name

      Enter a name for the route entry. In this example, enter VPCENTRY.

      Destination CIDR Block

      Enter the destination CIDR block. In this example, use the IP address of the on-premises IDC server, 172.16.0.124/32.

      Next Hop Type

      Select NAT Gateway.

      NAT Gateway

      Select the VPC NAT gateway that was created in Step 3: Create a VPC NAT Gateway.

    Step 5: Create a custom route table and route entry

    Create a custom route table for the VSW2 VSwitch and add a route entry that points to the VPN Gateway.

    For information about the regions that support custom route tables, see Route tables.

    1. Log on to the VPC console.

    2. In the navigation pane on the left, click Route Tables.

    3. In the top navigation bar, select the region to which the route table belongs.

    4. On the Route Tables page, click Create Route Table.

    5. On the Create Route Table page, configure the following parameters and click OK.

      Parameter

      Description

      Resource Group

      Select the resource group for the route table. In this example, All is selected.

      VPC

      Select the VPC for the route table. In this example, VPC1 is selected.

      Name

      Enter a name for the route table. In this example, enter VPNVTB.

      Description

      Enter a description for the route table. In this example, enter Custom route table for VPN Gateway.

    6. On the Associated vSwitch tab, click Associate vSwitch.

    7. In the Associate vSwitch dialog box, select the VSwitch to associate and click OK.

      This example uses the VSW2 VSwitch.

    8. On the route table details page, navigate to the Route Entry List > Custom Route tab and click Add Route Entry.

    9. In the Add Route Entry panel, configure the following parameters and click OK.

      Parameter

      Description

      Name

      Enter a name for the route entry. In this example, enter VPCNATENTRY.

      Destination CIDR Block

      Enter the destination CIDR block. In this example, enter the IP address of the server in the on-premises IDC, 172.16.0.124/32.

      Next Hop Type

      Select the type of the next hop. In this example, select VPN Gateway.

      VPN Gateway

      Select the VPN Gateway instance. In this example, select the VPN Gateway created in Step 1: Configure an IPsec-VPN connection.

    Step 6: Create SNAT and DNAT entries

    1. Log on to the NAT Gateway console.

    2. In the left-side navigation pane, choose NAT Gateway > VPC NAT Gateway.

    3. In the top navigation bar, select the region where you want to create the NAT gateway.

    4. Perform the following steps to create an SNAT entry:

      1. On the VPC NAT Gateway page, find the target VPC NAT Gateway instance and click SNAT in the Actions column.

      2. On the SNAT tab, click Create SNAT Entry.

      3. On the Create SNAT Entry page, set the following parameters and click OK.

        Parameter

        Description

        SNAT Entry

        Select Select vSwitch. From the Select vSwitch list, select the vSwitch where ECS1 resides. This example uses VSW1. The vSwitch CIDR Block field then displays the CIDR block of VSW1.

        Select NAT IP Address

        From the drop-down list, select the NAT IP address to use for accessing external private networks. This example uses the default NAT IP address.

        Entry Name

        Enter a name for the SNAT entry.

        The name must be 2 to 128 characters long, start with a letter or a Chinese character, and can contain digits, underscores (_), and hyphens (-).

    5. Return to the VPC NAT Gateway page and perform the following steps to create a DNAT entry.

      1. On the VPC NAT Gateway page, find the target VPC NAT Gateway instance and click DNAT in the Actions column.

      2. On the DNAT tab, click Create DNAT Entry.

      3. On the Create DNAT Entry page, set the following parameters and click OK.

        Parameter

        Description

        Select NAT IP Address

        Select the NAT IP address that external private networks can use to access resources in your VPC. This example uses the default NAT IP address.

        Select Private IP Address

        Select the private IP address to make accessible through the DNAT entry. For this example, select Select by ECS or ENI and then select the private IP address of ECS1.

        Port Settings

        Select the DNAT mapping method. For this example, select Specific Port, which is also known as port mapping.

        Set Frontend Port to 22, Backend Port to 22, and Protocol to TCP.

        Entry Name

        Enter a name for the DNAT entry.

        The name must be 2 to 128 characters long, start with a letter or a Chinese character, and can contain digits, underscores (_), and hyphens (-).

    Step 7: Configure routes for the VPN Gateway

    Configure routes in the VPN Gateway and publish them to the VPC route table to enable communication between your on-premises data center and the VPC.

    1. Log on to the VPN Gateway console.

    2. In the top navigation bar, select the region where the VPN gateway instance resides.

    3. In the left navigation pane, choose Interconnections > VPN > VPN Gateways.

    4. On the VPN Gateway page, find the VPN gateway that you want to manage and click the ID of the VPN gateway.

    5. On the Destination-based Route Table tab, click Add Route Entry.

    6. In the Add Route Entry panel, configure the following parameters and click OK.

      Parameter

      Description

      Destination CIDR Block

      Enter the private CIDR block of the on-premises data center. For this example, enter 172.16.0.0/12.

      Next Hop Type

      Select IPsec Connections.

      Next Hop

      Select the IPsec connection that you created in Step 1: Configure an IPsec connection.

      Publish to VPC

      Specifies whether to publish the new route to the VPC route table. In this example, select Yes.

      Weight

      Select a weight for the route. In this example, select 100.

      • 100: High priority.

      • 0: Low priority.

    Step 8: Test connectivity

    1. Log in to ECS1 in VSW1. For details, see Connection methods.

    2. Run the ping <IP address of the data center server> command to verify that ECS1 can access the data center server.

      In this example, run the following command.

      ping 172.16.0.124

      The result confirms that ECS1 can access the data center server.

      [root@iZm5ed xxx 6xsog69bpZ ~]# ping 172.16.0.124
PING 172.16.0.124 (172.16.0.124) 56(84) bytes of data.
64 bytes from 172.16.0.124: icmp_seq=1 ttl=62 time=15.6 ms
64 bytes from 172.16.0.124: icmp_seq=2 ttl=62 time=15.6 ms
64 bytes from 172.16.0.124: icmp_seq=3 ttl=62 time=15.7 ms
64 bytes from 172.16.0.124: icmp_seq=4 ttl=62 time=15.6 ms
64 bytes from 172.16.0.124: icmp_seq=5 ttl=62 time=15.6 ms
64 bytes from 172.16.0.124: icmp_seq=6 ttl=62 time=15.6 ms
64 bytes from 172.16.0.124: icmp_seq=7 ttl=62 time=15.6 ms
^C
--- 172.16.0.124 ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6008ms
rtt min/avg/max/mdev = 15.578/15.605/15.665/0.136 ms

    3. Log in to the data center server and run the ssh root@<NAT_IP> command to test if the data center server can remotely connect to ECS1. In the command, replace <NAT_IP> with the default NAT IP address of the VPC NAT Gateway. Then, enter the login password for ECS1 when prompted.

      In this example, run the following command.

      ssh 10.0.1.43

      The result shows that the data center server can access ECS1 by using the DNAT feature of the VPC NAT Gateway.

      [root@iZ2ze9r3txxxz25cs7cfZ ~]# ssh 10.0.1.43
root@10.0.1.43's password:
Welcome to Alibaba Cloud Elastic Compute Service !
Updates Information Summary: available
    6 Security notice(s)
    6 Moderate Security notice(s)
Run "dnf upgrade-minimal --security" to apply all updates.
Last login: Tue Nov 30 17:40:43 2021 from 172.16.0.124
[root@iZm5edtfgxxxixsog69bpZ ~]#