This topic answers common questions about network types for ApsaraDB RDS.
What network types does ApsaraDB RDS support, and what are the differences?
ApsaraDB RDS supports the following two network types:
-
Virtual Private Cloud (VPC): A VPC is a logically isolated network environment. A VPC provides a high level of security. We recommend using this network type. You can customize the route table, IP address range, and gateway in a VPC. You can also use Express Connect or a VPN to connect your on-premises data center to an Alibaba Cloud VPC. This setup creates a hybrid cloud and simplifies migrating your applications. For more information, see What is a VPC?.
NoteAll ApsaraDB RDS instances support VPC.
-
classic network: Instances in a classic network are not isolated from each other and rely solely on whitelists for access control.
NoteOnly ApsaraDB RDS instances with high-performance local disks support the classic network.
The following table compares the features of a VPC and the classic network.
|
Comparison point |
VPC |
Classic network |
|
Layer 2 logical isolation |
Supported |
Not supported |
|
Custom private CIDR block |
Supported |
Not supported |
|
Private IP address planning |
Unique within a VPC; can be reused across VPCs. |
Unique within the classic network. |
|
Private network communication |
Communication is allowed within a VPC but isolated between VPCs. |
Communication is allowed within the same region under the same account. |
|
Tunneling technology |
Supported |
Not supported |
|
Custom router |
Supported |
Not supported |
|
Route table |
Supported |
Not supported |
|
vSwitch |
Supported |
Not supported |
|
SDN |
Supported |
Not supported |
|
Self-managed NAT gateway |
Supported |
Not supported |
|
Self-managed VPN |
Supported |
Not supported |
We recommend using a VPC for enhanced security.
Can I switch the network type, and what is the impact?
You can switch an instance from the classic network to a VPC, but not from a VPC to the classic network. For information about this process and its impact, see Change the network type.
How do I change the VPC of an instance?
-
For some instances, you can directly change the VPC and vSwitch. For more information, see the following topics:
-
For other instances:
Purchase a new instance in the destination VPC and then migrate the data to the new instance. For more information, see the following topics:
Troubleshoot VPN connections to RDS
Follow these steps if you experience connection issues, such as a timeout, when accessing an instance's internal endpoint over a VPN. A timeout can occur if no response is received after a SYN packet is sent to establish a TCP connection.
-
Verify that the VPN tunnel status and route configurations are correct. Log on to the VPC console. Choose Interconnections > VPN > VPN Gateways to check the status of your VPN gateway instance. Then, choose IPsec Connections to confirm that the connection status is Connected and that the health check is normal.
-
Ensure the VPN client's CIDR block is in the ApsaraDB RDS whitelist. Log on to the RDS console, go to the details page of the target instance, and click Whitelist and Security Group. In the whitelist settings, add the CIDR block of the client network, such as 10.0.0.0/8.
-
Check the VPC route table configuration. In the VPC console, choose Route Tables and go to the details page of the target route table. Verify that the custom route entry for the destination CIDR block correctly points to the VPN gateway as the next hop.
-
After you confirm that all configurations are correct, simultaneously capture packets on your client and on an ECS instance in the same VPC as the ApsaraDB RDS instance. Compare the TCP session packet sequences to identify where packets are dropped or where abnormal retransmissions occur.