All Products
Search
Document Center

:Introduction to RDS Custom networking

Last Updated:Jun 20, 2026

This topic describes the default network settings for RDS Custom instances. This topic also describes how to initialize the network environment for custom images.

Default network settings for RDS Custom instances

By default, two network interface controllers (NICs) are configured for an RDS Custom instance in dual-NIC mode: a primary NIC and an elastic network interface (ENI). In most cases, the primary NIC is named eth0 and the ENI is named eth1.

  • eth0: created in the management virtual private cloud (VPC). Only traffic from the management CIDR block 100.100.0.0/16 of the Elastic Compute Service (ECS) instance can flow over eth0 due to security group limits.

    Note

    IP addresses 100.100.2.136 and 100.100.2.138 are the IP addresses of the Private DNS service. Traffic from the IP addresses flows over eth1.

  • eth1: created in the user VPC. In most cases, all traffic flows over eth1 except for traffic from the management CIDR block of the ECS instance. Security groups are used to manage inbound and outbound traffic.

The following figures show information about the NICs, route tables, and iptables firewall rules of your RDS Custom instance after you connect to the instance. For more information, see Connect to an RDS Custom instance.

  • Run the ip address show command to check the status of the NICs on the instance.

    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
        link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
        inet 127.0.0.1/8 scope host lo
           valid_lft forever preferred_lft forever
        inet6 ::1/128 scope host
           valid_lft forever preferred_lft forever
    2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
        link/ether 00:16:3e:10:32:d8 brd ff:ff:ff:ff:ff:ff
        inet 20.xxx.xxx.xxx/16 brd 20.xxx.xxx.xxx scope global dynamic eth0
           valid_lft 315357595sec preferred_lft 315357595sec
        inet6 fe80::xxx:xxx:xxx:xxx/64 scope link
           valid_lft forever preferred_lft forever
    3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
        link/ether 00:16:3e:48:f2:e7 brd ff:ff:ff:ff:ff:ff
        inet 172.xxx.xxx.xxx/20 brd 172.xxx.xxx.xxx scope global dynamic eth1
           valid_lft 315357597sec preferred_lft 315357597sec
        inet6 fe80::xxx:xxx:xxx:xxx/64 scope link
           valid_lft forever preferred_lft forever
  • Run the route -n command to view the route table of the instance.

    Traffic flows only over eth1.

    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    0.0.0.0         172.xxx.xxx.xxx 0.0.0.0         UG    0      0        0 eth1
    100.100.0.0     20.xxx.xxx.xxx  255.255.0.0     UG    0      0        0 eth0
    100.100.2.136   172.xxx.xxx.xxx 255.255.255.255 UGH   0      0        0 eth1
    100.100.2.138   172.xxx.xxx.xxx 255.255.255.255 UGH   0      0        0 eth1
    169.xxx.xxx.xxx 0.0.0.0         255.255.0.0     U     1003   0        0 eth1
    172.xxx.xxx.xxx 0.0.0.0         255.255.240.0   U     0      0        0 eth1
  • Run the iptables -L -n command to view the default iptables configuration of the instance.

    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination
    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination

If you fail to connect to your RDS Custom instance after you manage the route tables, iptables firewall rules, and NIC configurations, including eth0 restart, you can restart the instance to initialize the network environment for the instance. For more information, see Restart an RDS Custom instance.

Warning

The RDS Custom instance uses the /etc/rds_custom_init.sh script to perform network initialization. Do not delete this script, or network initialization will fail.

Initialize the network environment for custom images

When you create an RDS Custom instance from a custom image, RDS Custom automatically configures the /etc/rds_custom_init.sh network initialization script for most public images. Supported images include Alibaba Cloud Linux 3, Alibaba Cloud Linux 2, CentOS 8, CentOS 7, Debian 11, Debian 10.5, AlmaLinux 9.2, Ubuntu 22, Ubuntu 20, and Ubuntu 16. To use other custom images, you must manually create the rds_custom_init.sh script in the source instance before you create the custom image.

The rds_custom_init.sh script provides the following key functions:

  1. Use the network configuration for eth1 and start related services for systems that cannot automatically activate ENIs.

  2. Modify the route configuration to point the default route to eth1 and point the management CIDR block 100.100.0.0/16 of the ECS instance to eth0.

  3. Modify the route configuration to point the IP addresses 100.100.2.136 and 100.100.2.138 of the Private DNS service to eth1.

Important

When an RDS Custom instance starts, the system records the gateway of eth0 in the /etc/eth0_gateway file and automatically configures the /etc/rds_custom_init.sh script for most public images. If you plan to perform any network-related initializations on the instance, ensure that you manually run the /etc/rds_custom_init.sh script after your initializations are complete. If the eth1 interface becomes unavailable (for example, its IP address is not recognized), contact us or reconfigure the network to restore eth1 functionality.

Manually create the script and configure settings for the script to run at startup

  1. Create the rds_custom_init.sh script in the /etc directory with the following content.

    The rds_custom_init.sh script

    #!/bin/bash
    echo "RDS CUSTOM INIT START, $(date)" >> /tmp/rds_custom_init.log
    flag=0
    for ((i=1; i<=5; i++)); do
        eth1_ip=$(ip address show eth1 | grep "inet " | awk "{print \$2}" | cut -d'/' -f1)  
        if [[ -n "$eth1_ip" ]]; then
            break
        else
            sleep 1
        fi
    done
    eth0_gateway=$(ip route | grep "default via " | grep "eth0" | awk "{print \$3}")
    # check eth0_gateway
    if [ -z "$eth0_gateway" ]; then
        if [ -f /etc/eth0_gateway ]; then
            eth0_gateway=$(cat /etc/eth0_gateway)
        else
            echo "No gateway found for eth0, and /etc/eth0_gateway file does not exist." >> /tmp/rds_custom_init.log
            exit 0
        fi
    fi
    if [ -z "$eth1_ip" ] && ip address show | grep -q "eth1"; then
        if lsb_release -a 2>/dev/null | grep -q -e "Ubuntu 16.04" -e "Debian"; then
          sed -i 's/eth0/eth1/g' /etc/network/interfaces
          echo "auto eth0" >> /etc/network/interfaces
          echo "iface eth0 inet dhcp" >> /etc/network/interfaces
          sudo systemctl restart networking
          flag=1
          echo "UP ETH1 FOR UBUNTU 16.04 or Debian, $(date)" >> /tmp/rds_custom_init.log
        else   
          HWADDR=$(ip address show eth1 | grep "link/ether" | awk "{print \$2}")
          echo -e "DEVICE=eth1\nBOOTPROTO=dhcp\nONBOOT=yes\nTYPE=Ethernet\nUSERCTL=yes\nPEERDNS=no\nIPV6INIT=no\nPERSISTENT_DHCLIENT=yes\nHWADDR=$HWADDR\nDEFROUTE=yes" | tee /etc/sysconfig/network-scripts/ifcfg-eth1 > /dev/null
          service network restart
          echo "UP ETH1, $(date)" >> /tmp/rds_custom_init.log
        fi
    fi
    eth1_ip=$(ip address show eth1 | grep "inet " | awk "{print \$2}" | cut -d'/' -f1)
    if [ "$flag" -eq 0 ] && lsb_release -a 2>/dev/null | grep -q "Ubuntu 16.04"; then
      sudo systemctl restart networking
      echo "UP ETH1 FOR UBUNTU 16.04, $(date)" >> /tmp/rds_custom_init.log
    fi
    if [ -n "$eth1_ip" ]; then
        ip route add 100.100.0.0/16 via $eth0_gateway dev eth0 2> /dev/null
        keep_route="100.100.0.0/16 via $eth0_gateway dev eth0"
        routes=$(ip route | grep "dev eth0")
        echo "$routes" | while read -r route; do
          if [[ "$route" != "$keep_route" ]]; then
            prefix=$(echo "$route" | awk "{print \$1}")
            ip route delete $prefix dev eth0 > /dev/null
          fi
        done
        echo "DELETE IP ROUTE FOR ETH0, $(date)" >> /tmp/rds_custom_init.log
        eth1_gateway=$(ip route | grep "default via " | grep "eth1" | awk "{print \$3}")
        if ip route | grep -q "100.100.2.136 via $eth1_gateway dev eth1"; then
          ip route delete 100.100.2.136 via "$eth1_gateway" dev eth1
        fi
        if ip route | grep -q "100.100.2.138 via $eth1_gateway dev eth1"; then
          ip route delete 100.100.2.138 via "$eth1_gateway" dev eth1
        fi
        ip route add 100.100.2.136 via $eth1_gateway dev eth1 2> /dev/null
        ip route add 100.100.2.138 via $eth1_gateway dev eth1 2> /dev/null
        ip route delete default via $eth1_gateway dev eth1 2> /dev/null
        ip route add default via $eth1_gateway dev eth1 metric 0 2> /dev/null
    fi
    echo "RDS CUSTOM INIT FINISHED, $(date)" >> /tmp/rds_custom_init.log
  2. Run the chmod a+x /etc/rds_custom_init.sh command to grant executable permissions to the script.

  3. Edit the /etc/rc.local file to configure the rds_custom_init.sh script to run on startup.

    • For operating systems other than Ubuntu, add /etc/rds_custom_init.sh to the /etc/rc.local file and grant the necessary permissions to /etc/rc.local.

      chmod 777 /etc/rc.local
    • For Ubuntu operating systems, configure and enable the rc-local.service.

      1. Edit the /lib/systemd/system/rc-local.service file and add the following content.

        [Install]
        WantedBy=multi-user.target
      2. Configure the rc-local.service to start on startup.

        # Configure the service to run at startup.
        systemctl enable rc-local.service
        # Check whether the service is configured to run at startup.
        systemctl is-enabled rc-local.service
      3. Start the rc-local.service.

        # Start the service. 
        systemctl start rc-local.service
        # Check the service.
        systemctl status rc-local.service
      Note

      By default, Ubuntu 20.04, Ubuntu 22.04, and Ubuntu 24.04 support the secondary ENIs that are bound in automatic configuration. If automatic configuration fails, perform the following operations.

      Manual configuration

      1. Run the following command to open the configuration file of the secondary ENI:

        vi /etc/netplan/eth1-netcfg.yaml
      2. Add the information about the secondary ENI to the configuration file. Then, save and exit the configuration file.

        network:
          version: 2
          renderer: networkd
          ethernets:
            eth1:
              dhcp4: yes
              dhcp6: no
      3. Run the following command to apply the configuration:

        netplan apply

Related topics