All Products
Search

This Product

    Virtual Private Cloud:Control inbound traffic to a VPC with a gateway route table

    Document Center

    Virtual Private Cloud:Control inbound traffic to a VPC with a gateway route table

    Last Updated:Jun 20, 2026

    You can use an IPv4 gateway or an IPv6 gateway with a gateway route table to forward inbound internet traffic to a security appliance for deep inspection and filtering. This enhances security by preventing malicious attacks and unauthorized access. This topic describes how to use an IPv4 gateway and a gateway route table to control traffic that enters a VPC.

    Scenario

    Some organizations deploy third-party security appliances in a VPC to scrub inbound internet traffic. These appliances can be network security hardware or software solutions from independent vendors, such as firewalls or intrusion detection systems. By modifying system route entries in a gateway route table and associating the table with an IPv4 gateway, you can redirect inbound internet traffic to a security appliance to inspect and control traffic entering your VPC.

    image

    Prerequisites

    • You have created a VPC in the China (Shanghai) region and two ECS instances, named ECS-A and ECS-B, within the VPC.

    • You have created two custom route tables and associated them with vSwitch 1 and vSwitch 2, respectively.

    Procedure

    Step 1: Create IPv4 gateway and associate route table

    1. Create and activate an IPv4 gateway.

      1. Log on to the IPv4 gateway console. In the top navigation bar, select the region where the VPC is located. This example uses the China (Shanghai) region.

      2. Click Create IPv4 Gateway. On the Create IPv4 Gateway page, select a Resource Group and configure a tag as required. Then, select the target VPC from the VPC drop-down list and click Create.

      3. Select the route table for the vSwitch that contains ECS-A and click Activate.

        • When you activate the gateway, the system adds a default route entry with a destination CIDR block of 0.0.0.0/0 that points to the IPv4 gateway. This route entry enables internet access for the vSwitch. If a default route entry with the destination CIDR block 0.0.0.0/0 already exists, the system cannot add another default route entry for the IPv4 gateway.

        • Network traffic within the VPC is not affected before you activate the IPv4 gateway. However, traffic path switching during activation may cause a brief network interruption.

        In the Select Route Table section, select the custom route table that you want to associate. We recommend selecting a custom route table instead of the main route table. Then, click Activate.

      4. The IPv4 gateway is activated and the vSwitch route table is configured.

        After you create the IPv4 gateway, confirm that its Status is Available. This status indicates the gateway is active and its route table is configured.

    2. Create a gateway route table.

      1. Log on to the route table console. In the top navigation bar, select the region where the IPv4 gateway is located. This example uses the China (Shanghai) region.

      2. Click Create Route Table, select the VPC, set Associated Resource Type to Border Gateway, specify a name for the route table, and then click OK.

    3. Associate the gateway route table with a border gateway.

      1. On the details page of the gateway route table, associate a border gateway.

        In the dialog box that appears, select the target IPv4 gateway whose status is Bindable, and click OK.

      2. After the binding is complete, confirm that the status of the border gateway is Available. On the Bound Border Gateways tab, a status of Available indicates that the binding is successful.

    Step 2: Configure the security appliance

    Important

    In this scenario, the ECS-A instance acts as a security appliance and you must enable IP forwarding on it. If you use a third-party security appliance, contact the appliance provider for assistance with deployment based on your business requirements.

    This example uses an ECS instance that runs Alibaba Cloud Linux 3.2104 64-bit.

    Log on to the ECS-A instance and run the following commands to configure IP forwarding.

    Permanent

    # Permanently enable IP forwarding by writing the setting to the configuration file.
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
# Apply the change immediately.
sysctl -p

    Temporary

    # Temporarily enable IP forwarding. This setting does not persist after a restart.
sysctl -w net.ipv4.ip_forward=1

    Step 3: Configure routes

    1. Configure a custom route table for outbound traffic.

      1. On the Route Tables page, find the custom route table for the vSwitch containing the ECS-B instance, and click the route table ID.

      2. Go to the Route Entry List > Custom Route tab and click Add Route Entry. Set Destination CIDR Block to 0.0.0.0/0, set Next Hop Type to ECS Instance, and select ECS-A from the ECS Instance drop-down list.

    2. Configure the gateway route table for inbound traffic.

      1. On the Route Tables page, find the gateway route table that you created and click its ID.

      2. Go to the Route Entry List > System Route tab to view the system route entries. By default, the system adds system route entries with the destination CIDR block of each vSwitch.

      3. Edit the route entry whose Destination CIDR Block corresponds to vSwitch 2, and set the next hop to the ECS-A instance, which acts as the security appliance. For the system route entry, click Edit. In the Edit Route Entry dialog box, set Next Hop Type to ECS Instance and select ECS-A from the ECS Instance drop-down list.

      4. After you complete the configuration, the system converts the system route entry into a custom route entry. Confirm that the status of the route entry is Available.

        On the route entry list page, click the Custom Route Entries tab to view details about the route entry, such as its destination CIDR block (for example, 10.0.1.0/24) and next hop (an ECS instance).

    Verify the results

    Make sure the network ACL and security group configurations allow connectivity for testing the ECS instances in the VPC.

    Verify inbound internet traffic

    Open a browser and enter http://<EIP of ECS-B>.

    The page returns This is ECS-B!. This indicates that the request reached the ECS-B instance.

    Verify traffic flow through ECS-A

    Log on to the ECS-A instance and run the tcpdump dst host <Private IP address of ECS-B> command to capture traffic destined for the ECS-B instance.

    Open a browser and enter the EIP of the ECS-B instance. Then, check the packet capture result on the ECS-A instance.

    [root@ECS-A ~]# tcpdump dst host 10.0.1.221
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
17:33:36.662426  IP 140.2xxx.xxx.19404 > 10.0.1.221.http: Flags [S], seq 884222365, w
17:33:36.662445  IP 140.2xxx.xxx.19404 > 10.0.1.221.http: Flags [S], seq 884222365, w
17:33:36.662818  IP 140.2xxx.xxx.37526 > 10.0.1.221.http: Flags [S], seq 3020843667,
17:33:36.662823  IP 140.2xxx.xxx.37526 > 10.0.1.221.http: Flags [S], seq 3020843667,
17:33:36.676731  IP 140.2xxx.xxx.19404 > 10.0.1.221.http: Flags [.], ack 1519927262,
17:33:36.676737  IP 140.2xxx.xxx.19404 > 10.0.1.221.http: Flags [.], ack 1, win 2058

    More operations

    Manage IPv6 traffic

    An IPv4 gateway controls public IPv4 traffic at the border of a VPC. To control IPv6 traffic that enters a VPC, you must use an IPv6 gateway and associate it with a gateway route table.

    The system automatically creates an IPv6 gateway for a VPC that has an IPv6 CIDR block. Make sure that you have enabled IPv6 public bandwidth for the IPv6 address of the ECS instance to enable communication between the ECS instance in the VPC and the IPv6 internet.
    image

    1. Create a gateway route table and associate it with the IPv6 gateway.

      1. Log on to the route table console. In the top navigation bar, select the region where the IPv6 gateway is located.

      2. Click Create Route Table, select the VPC, set Associated Resource Type to Border Gateway, specify a name for the route table, and then click OK.

      3. On the details page of the gateway route table, click Associated Border Gateway > Associate Border Gateway, and then select the IPv6 gateway to associate.

    2. Configure the gateway route table to route inbound traffic.

      1. Go to the Route Entry List > System Route tab to view the system route entries. By default, the system adds system route entries with the destination CIDR block of each vSwitch.

      2. Edit the IPv6 route entry whose Destination CIDR Block corresponds to vSwitch 2, and set the next hop to the ECS-A instance, which acts as the security appliance.

    Adjust inbound internet routes

    You can adjust inbound internet routes by modifying the system route entries in the gateway route table.

    The next hop of an IPv4 or IPv6 route can be an ECS Instances, an ENI, a GWLB Endpoint, or a Route Target Group.

    • You can only modify system route entries in a gateway route table. You cannot create custom route entries.

    • After you edit and save a system route entry, the system converts it into a custom route entry. If you delete the custom route entry, it reverts to a system route entry.

    • When you edit a system route entry in a gateway route table, note the following about the next hop types:

      • ECS instance/elastic network interface (ENI): Allows access to the specified instance or ENI within the vSwitch. This is often used to securely redirect public traffic to a specific ECS instance or ENI. If you need to change the ECS instance or ENI, you must delete the route entry and then edit the system route information again. You cannot directly replace the instance or ENI.

      • GWLB endpoint: Allows access to the specified endpoint within the vSwitch. This is used to redirect public traffic to third-party security appliances in Gateway Load Balancer (GWLB) scenarios.

        For information about the regions that support modifying the next hop to a GWLB Endpoint, see Regions that support GWLB.

      • Route Target Group: You can configure two next hop instances in active/standby mode. The system automatically performs health checks on the instances. If an instance becomes unhealthy, the system automatically switches over traffic to achieve zone-level disaster recovery and shorten the recovery time objective (RTO).

    Unbind a gateway route table

    You can unbind a gateway route table from an IPv4 or IPv6 gateway. Once unbound, the border gateway no longer provides gateway routing capabilities.

    1. On the Route Tables page, find the target gateway route table and click its ID.

    2. Click the Associated Border Gateway tab, find the target border gateway, and click Unbind in the Actions column.

    3. In the dialog box that appears, click OK.

    Delete a gateway route table

    You must unbind a gateway route table from a border gateway before you can delete the route table.

    1. On the Route Tables page, find the target gateway route table, and then click Delete in the Actions column.

    2. In the Delete Route Table dialog box, click OK.

    Related documents