ALB instances support Internet-facing and internal-facing network types. Change the network type to control public or VPC-only access.
Instance network types
Instance type | Internet-facing ALB instance | Internal-facing ALB instance |
Scenario | You need to access backend services over the Internet. | You only need to access backend services from an Alibaba Cloud VPC. |
IP address assignment | An elastic IP address (EIP) and a private IP address are assigned. You can associate an Anycast EIP with the ALB instance. | Only a private IP address is assigned. |
Access method | Accessible over both the Internet and a private network. | Accessible only over a private network. |
Diagram | ||
Billing | Instance fees, LCU fees, and Internet data transfer fees (charged on the EIP) apply. | Only instance fees and LCU fees apply. |
IP versions
IP version | IP addresses provided for external services by default (per zone) | Description |
IPv4 |
|
|
Dual-stack |
|
|
Dual-stack is supported only in some regions.
The network type of a dual-stack ALB instance is determined by its IPv4 address. If the IPv4 address is private, the instance is internal-facing; if the IPv4 address is public, the instance is Internet-facing.
You can only create new dual-stack instances. Upgrading an existing IPv4 instance to dual-stack is not supported.
Access control list (ACL) entries support only IPv4 addresses.
An upgraded ALB instance assigns private IPv4 and IPv6 addresses for external services from each specified vSwitch.
Public IP address types
ALB supports two types of public IP addresses:
Type | Description |
EIP | A public IP address that you can independently purchase and associate with VPC-based CLB instances, internal-facing ALB instances, or Internet NAT gateways. What is EIP? |
Anycast EIP | A public IP address with global anycast capabilities. What is Anycast EIP? |
For a comparison of EIPs and Anycast EIPs, see Anycast EIP vs. EIP.
Prerequisites
Ensure the following:
An ALB instance is created. Create an ALB instance
Switch an IPv4 ALB instance from internal to Internet-facing
After this change, assign EIPs or Anycast EIPs to the ALB instance. Internet data transfer fees apply. EIP billing, Anycast EIP billing.
Log on to the ALB console.
In the top navigation bar, select the region of the ALB instance.
On the Instances page, click the ID of the internal-facing ALB instance.
On the Instance Details tab, find Network Type in the Basic Information section and click Change Network Type next to IPv4:Private.
In the Change Network Type dialog box, select an IP Type and assign public IP addresses. Option A: Assign EIPs Option B: Assign Anycast EIPs For Anycast EIP limits and procedures, see Associate an Anycast EIP for nearby access across multiple regions.
Set IP Type to EIP.
Select Purchase EIP from the Assign EIP drop-down list, or select an existing Anycast EIP, and click OK.
NoteAssign an EIP to each zone in the list.
To use an EIP with a specific IP address, replace the EIP by adding or removing zones. Modify the configurations of ALB instances.
Changing the network type automatically releases or disassociates all assigned EIPs. Released EIPs cannot be restored.
View EIP details in the EIP console.
Purchased EIPs use pay-as-you-go billing with pay-by-data-transfer metering, BGP (Multi-ISP) lines, and Anti-DDoS Origin Basic protection.
NoteAssign Anycast EIPs to all zones in the list.
Switching an ALB instance to internal-facing or releasing it automatically disassociates and releases associated Anycast EIPs.
View Anycast EIP details in the Anycast EIP console.
Click OK.
Return to the Instance Details tab and verify the Network Type value. The change takes about 1 minute. When IPv4 shows Public, the ALB instance is Internet-facing.
Switch an IPv4 ALB instance from Internet-facing to internal
After this change, all public IP addresses are disassociated from the ALB instance and its DNS records are updated. This disrupts Internet-facing traffic.
Log on to the ALB console.
In the top navigation bar, select the region of the ALB instance.
On the Instances page, click the ID of the Internet-facing ALB instance.
On the Instance Details tab, find Network Type in the Basic Information section and click Change Network Type next to the public IPv4 address.
In the confirmation message, review the impacts and click OK.
Return to the Instance Details tab and verify the Network Type value. The change takes about 1 minute. When IPv4 shows Private, the ALB instance is internal-facing.
Switch a dual-stack ALB instance to public IPv6
To switch from private IPv4 to public IPv4 on a dual-stack instance, follow the same steps as Switch an IPv4 ALB instance from internal to Internet-facing.
The following steps describe how to switch to public IPv6.
Switching to public IPv6 enables Internet bandwidth for the IPv6 gateway. This bandwidth is billed and automatically enabled or disabled based on the ALB network type. See IPv6 gateway billing.
Log on to the ALB console.
In the top navigation bar, select the region of the ALB instance.
On the Instances page, click the ID of the internal-facing ALB instance.
On the Instance Details tab, find Network Type in the Basic Information section and click Change Network Type next to the IPv6 address.
In the Change Network Type message, review the impacts and click OK.
NoteIf the VPC lacks an IPv6 gateway, follow the console prompts to create one.
Return to the Instance Details tab and verify the Network Type value. The change takes about 1 minute. When IPv6 shows Public, the ALB instance supports public IPv6 traffic.
Switch a dual-stack ALB instance to private IPv6
To switch from public IPv4 to private IPv4 on a dual-stack instance, follow the same steps as Switch an IPv4 ALB instance from Internet-facing to internal.
The following steps describe how to switch to private IPv6.
Log on to the ALB console.
In the top navigation bar, select the region of the ALB instance.
On the Instances page, click the ID of the Internet-facing ALB instance.
On the Instance Details tab, find Network Type in the Basic Information section and click Change Network Type next to the IPv6 address.
In the Disable Elastic IPv6 message, review the impacts and click Disable.
Return to the Instance Details tab and verify the Network Type value. The change takes about 1 minute. When IPv6 shows Private, the ALB instance no longer supports public IPv6 traffic.
Limitations
Anycast EIP with ALB
Anycast EIPs can be associated with ALB instances in the following regions:
Area | Regions |
China | China (Hong Kong) |
Asia Pacific | South Korea (Seoul), Japan (Tokyo), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok) |
Europe and Americas | UK (London), US (Virginia), US (Silicon Valley), Germany (Frankfurt) |
EIP with ALB
EIPs assigned to different zones of the same ALB instance must be the same type. What types of EIPs can be associated with ALB instances?
Associate the EIP with an ALB instance before adding an Internet Shared Bandwidth instance in the ALB console. The EIP line type must match the Internet Shared Bandwidth line type. Modify the maximum bandwidth.
Billing
ALB is billed hourly, rounded up to 1 hour. Network type changes take effect immediately, but the current hour bills at the previous type. See ALB billing.
Change | Operation | Billing impact | Reference |
Private IPv4 to public IPv4 | Associate an EIP or Anycast EIP | Internet data transfer fees apply | |
Public IPv4 to private IPv4 | Disassociate EIPs or Anycast EIPs | Check the actual bill for details | - |
Private IPv6 to public IPv6 | Enable Internet bandwidth for the IPv6 gateway | IPv6 Internet bandwidth fees apply | |
Public IPv6 to private IPv6 | Disable Internet bandwidth for the IPv6 gateway | Check the actual bill for details | - |