All Products
Search

This Product

    Platform For AI:Accelerate internet access with a private gateway

    Document Center

    Platform For AI:Accelerate internet access with a private gateway

    Last Updated:Jul 13, 2026

    By default, DLC uses a shared internet gateway with limited bandwidth, which can result in slow downloads for large files. To increase upload and download speeds, you can create an Internet NAT Gateway in your instance's VPC, bind an EIP, and configure an SNAT entry. This setup allows the instance to access the internet at high speed through a private gateway.

    Prerequisites

    • You have created a VPC and a vSwitch. To prevent IP address conflicts with PAI cluster CIDR blocks, use the 192.168.0.0/16 CIDR block for your VPC. For more information, see Create and manage a VPC.

    • You have created a security group for the VPC. For more information, see Create a security group.

    Billing

    Internet NAT Gateway is a standalone product that is billed separately. For more information, see Internet NAT Gateway billing.

    Procedure

    1. Log on to the NAT Gateway console to create an Internet NAT Gateway. The key parameters are described in the following table. For details about other parameters, see Configuration steps.

      If you have multiple Internet NAT Gateway instances in your VPC, see High-availability deployment of an Internet NAT Gateway in a single availability zone for network design and deployment guidance.

      Parameter

      Description

      Region

      Select the region where your VPC is located. This region is selected by default.

      Network and Zone

      Select the VPC and vSwitch that match your DLC configuration.

      EIP

      If no EIP is available, click Purchase EIP and follow the on-screen instructions. We recommend setting Peak bandwidth as high as possible.

    2. Create an SNAT entry. On the Internet NAT Gateway page, click the name of the gateway you created, navigate to the SNAT tab, and then click Create SNAT Entry. When creating the entry, select Specify VPC and choose to use a single IP address. If you have purchased multiple IP addresses, you can choose to use them. For more configuration details, see Step 3: Create an SNAT entry. On the gateway's details page, go to the SNAT tab and confirm that the SNAT entry is created. The source CIDR block of the entry must be 0.0.0.0/0, which allows all ECS instances in the VPC to access the internet through this SNAT entry. Make sure the status is Available.

    3. Configure the VPC for a DLC job. Log on to the PAI console and select the same region as your VPC in the upper-left corner. When creating a DLC job, configure the VPC on its configuration page. The key parameters are described in the following table. For details about other parameters, see Create a DSW instance.

      Parameter

      Description

      VPC Settings

      These settings can be configured only when Resource Group is set to a public resource group.

      Select the VPC, vSwitch, and security group that you created.

      Security Group

      vSwitch

      Internet Access Gateway

      Select Private Gateway (recommended). DLC will access the internet through this private gateway. If you select Private Gateway (Recommended) but have not purchased an Internet NAT Gateway, bound an EIP, and configured an SNAT entry, the instance cannot access the internet.

    Appendix: Deny internet access to an instance

    If you have strict security requirements that prohibit computing resources such as DLC from accessing the internet, set Internet Access Gateway to Private Gateway (Recommended) when you create an instance. In the specified VPC, do not configure any egress networking components, such as an Internet NAT Gateway or SNAT entries. This ensures that the instance can only access data within the VPC and cannot access the internet.