Virtual Private Cloud:IPv4 gateway

Console

1. Go to the IPv4 Gateway page in the VPC console. Select the region where the VPC is deployed, and then click Create IPv4 Gateway.

2. Create IPv4 Gateway: Select the VPC for which you want to centralize Internet access.

3. Activate IPv4 Gateway: Select the route table that is associated with the public vSwitch. The system automatically adds a 0.0.0.0/0 route that points to the IPv4 gateway. This ensures that resources with a public IP address in the public vSwitch can access the Internet. If a route with a destination CIDR block of 0.0.0.0/0 already exists in the route table, click Activate Later. Then, change the next hop of the route to the IPv4 gateway and activate the gateway. After activation, the IPv4 gateway centrally controls Internet access for the VPC.

   • If an ECS instance uses a public IP address that is attached to an Internet NAT gateway to access the Internet, the ECS instance and the Internet NAT gateway must be deployed in different vSwitches. The route table for the vSwitch of the NAT gateway must contain a 0.0.0.0/0 route that points to the IPv4 gateway. The route table for the vSwitch of the ECS instance must contain a route that points to the NAT gateway in the public vSwitch.

   • If an ECS instance uses a static public IP address or an attached EIP to access the Internet, add a 0.0.0.0/0 route that points to the IPv4 gateway.

API

• Call CreateIpv4Gateway to create an IPv4 gateway.

• Call EnableVpcIpv4Gateway to activate the IPv4 gateway. Set RouteTableList to the route table associated with the public vSwitch. If this parameter is not specified, call CreateRouteEntry to add a 0.0.0.0/0 route that points to the IPv4 gateway.

Terraform

Unlike the console, the system does not automatically add a 0.0.0.0/0 route that points to the IPv4 gateway upon activation. You must manually configure the route.

Resource: alicloud_vpc, alicloud_vswitch, alicloud_vpc_ipv4_gateway, alicloud_route_table, alicloud_route_table_attachment, alicloud_vpc_route_entry, alicloud_instance, alicloud_security_group, alicloud_security_group_rule, alicloud_eip_address, alicloud_eip_association, alicloud_nat_gateway, alicloud_snat_entry

Data Sources: alicloud_zones

# Specify the region where you want to create the IPv4 gateway.
provider "alicloud" {
  region = "cn-hangzhou"
}

# Automatically obtain the list of zones where vSwitches can be created based on the data source.
data "alicloud_zones" "available_zones" {
  available_resource_creation = "VSwitch" # Query the zones where resources can be created in the VPC.
}

# Create a VPC. 
resource "alicloud_vpc" "example_vpc" {
  vpc_name   = "example_vpc_name"
  cidr_block = "10.0.0.0/16" # Specify the CIDR block. 
}

# Define the vSwitch configurations.
locals {
  vswitches = {
    vsw1 = {
      name       = "example_vsw1_name"
      cidr_block = "10.0.0.0/24"
      zone_index = 0
    }
    vsw2 = {
      name       = "example_vsw2_name"
      cidr_block = "10.0.1.0/24"
      zone_index = 1
    }
    vsw3 = {
      name       = "example_vsw3_name"
      cidr_block = "10.0.2.0/24"
      zone_index = 0
    }
    vsw4 = {
      name       = "example_vsw4_name"
      cidr_block = "10.0.3.0/24"
      zone_index = 0
    }
  }

  # Define the route table configurations.
  route_tables = {
    rt1 = {
      name        = "example_rt1_name"
      vswitch_key = "vsw1"
    }
    rt2 = {
      name        = "example_rt2_name"
      vswitch_key = "vsw2"
    }
    rt3 = {
      name        = "example_rt3_name"
      vswitch_key = "vsw3"
    }
    rt4 = {
      name        = "example_rt4_name"
      vswitch_key = "vsw4"
    }
  }

  # Define the instance configurations.
  instances = {
    instance1 = {
      name        = "example_instance1_name"
      vswitch_key = "vsw1"
    }
    instance2 = {
      name        = "example_instance2_name"
      vswitch_key = "vsw3"
    }
    instance3 = {
      name        = "example_instance3_name"
      vswitch_key = "vsw4"
    }
  }

  # Define the EIP configurations.
  eips = {
    eip1 = {
      name = "example_eip1_name"
    }
    eip2 = {
      name = "example_eip2_name"
    }
  }

  # Define the SNAT entry configurations.
  snat_entries = {
    snat1 = {
      instance_key = "instance2"
    }
    snat2 = {
      instance_key = "instance3"
    }
  }
}

# Create multiple vSwitches.
resource "alicloud_vswitch" "example_vsw" {
  for_each = local.vswitches

  vswitch_name = each.value.name
  cidr_block   = each.value.cidr_block
  vpc_id       = alicloud_vpc.example_vpc.id
  zone_id      = data.alicloud_zones.available_zones.zones[each.value.zone_index].id
}

# Create multiple custom route tables.
resource "alicloud_route_table" "example_route_table" {
  for_each = local.route_tables

  route_table_name = each.value.name
  vpc_id           = alicloud_vpc.example_vpc.id
}

# Associate the route tables with the vSwitches.
resource "alicloud_route_table_attachment" "example_route_table_attachment" {
  for_each = local.route_tables

  vswitch_id     = alicloud_vswitch.example_vsw[each.value.vswitch_key].id
  route_table_id = alicloud_route_table.example_route_table[each.key].id
}

# Specify the instance type.
variable "instance_type" {
  default = "ecs.e-c1m1.large"
}

# Specify the image ID.
variable "image_id" {
  default = "aliyun_3_x64_20G_alibase_20221102.vhd"
}

# Create a security group.
resource "alicloud_security_group" "example_security_group" {
  security_group_name = "example_security_group_name"
  vpc_id              = alicloud_vpc.example_vpc.id
}

# Create a security group rule. Modify the protocol and port number as needed.
resource "alicloud_security_group_rule" "allow_Internet" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group.id
  cidr_ip           = "0.0.0.0/0"
}

# Create multiple servers.
resource "alicloud_instance" "example_instance" {
  for_each = local.instances

  instance_name        = each.value.name
  vswitch_id           = alicloud_vswitch.example_vsw[each.value.vswitch_key].id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group.id]
  instance_charge_type = "PostPaid"           # Set the billing method to pay-as-you-go.
  spot_strategy        = "SpotWithPriceLimit" # Set the instance as a spot instance for which you can specify a maximum price.
}

# Create multiple EIPs.
resource "alicloud_eip_address" "example_eip" {
  for_each = local.eips

  address_name = each.value.name
  isp          = "BGP"
  netmode      = "public"
  bandwidth    = "1"
  payment_type = "PayAsYouGo"
}

# Associate the ECS instance with an EIP.
resource "alicloud_eip_association" "example_eip_ecs_association" {
  allocation_id = alicloud_eip_address.example_eip["eip1"].id
  instance_type = "EcsInstance"
  instance_id   = alicloud_instance.example_instance["instance1"].id
}

# Create an Internet NAT gateway.
resource "alicloud_nat_gateway" "example_natgw" {
  nat_gateway_name = "example_natgw_name"
  vpc_id           = alicloud_vpc.example_vpc.id
  vswitch_id       = alicloud_vswitch.example_vsw["vsw2"].id
  nat_type         = "Enhanced"
  eip_bind_mode    = "NAT" # Specify the EIP association mode. The value must be NAT.
  payment_type     = "PayAsYouGo"
}

# Associate the EIP with the Internet NAT gateway.
resource "alicloud_eip_association" "example_eip_natgw_association" {
  allocation_id = alicloud_eip_address.example_eip["eip2"].id
  instance_type = "NAT"
  instance_id   = alicloud_nat_gateway.example_natgw.id
}

# Add a route that points to the NAT gateway.
resource "alicloud_route_entry" "example_rt3_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt3"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "NatGateway"
  nexthop_id            = alicloud_nat_gateway.example_natgw.id
}

# Add a route that points to the NAT gateway.
resource "alicloud_route_entry" "example_rt4_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt4"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "NatGateway"
  nexthop_id            = alicloud_nat_gateway.example_natgw.id
}

# Create an SNAT entry.
resource "alicloud_snat_entry" "example_snat_entry" {
  for_each = local.snat_entries

  snat_table_id = alicloud_nat_gateway.example_natgw.snat_table_ids
  source_cidr   = alicloud_instance.example_instance[each.value.instance_key].primary_ip_address
  snat_ip       = alicloud_eip_address.example_eip["eip2"].ip_address
}

# Create an IPv4 gateway.
resource "alicloud_vpc_ipv4_gateway" "example_ipv4gw" {
  ipv4_gateway_name = "example_ipv4gw_name"
  vpc_id            = alicloud_vpc.example_vpc.id
  enabled           = true
}

# Add a route that points to the IPv4 gateway.
resource "alicloud_route_entry" "example_rt1_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt1"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

# Add a route that points to the IPv4 gateway.
resource "alicloud_route_entry" "example_rt2_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt2"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

Console

1. Go to the IPv4 Gateway page in the VPC console. Select the region where the VPC is deployed, and then click Create IPv4 Gateway.

2. Create IPv4 Gateway: Select the VPC that needs to access the non-standard private CIDR block.

3. Activate IPv4 Gateway: Select the route table that is associated with the vSwitch that needs to access the non-standard private CIDR block. The system automatically adds a 0.0.0.0/0 route that points to the IPv4 gateway. This ensures that resources in the vSwitch can access the non-standard private CIDR block based on more specific routes.

   • Ensure that the attached route table does not contain a route with the destination CIDR block 0.0.0.0/0. If it does, click Activate Later, delete the route, and then activate the route table again.

   • After activation, the IPv4 gateway centrally controls Internet-bound traffic, and all traffic is forwarded based on the route table.

API

• Call CreateIpv4Gateway to create an IPv4 gateway.

• Call EnableVpcIpv4Gateway to activate the IPv4 gateway. Set RouteTableList to the route table associated with the public vSwitch. If this parameter is not specified, call CreateRouteEntry to add a 0.0.0.0/0 route that points to the IPv4 gateway.

Terraform

Unlike the console, when you activate an IPv4 gateway, the system does not automatically add the 0.0.0.0/0 route pointing to the IPv4 gateway. You must configure the route manually.

Resource: alicloud_vpc, alicloud_vswitch, alicloud_vpc_ipv4_gateway, alicloud_route_table, alicloud_route_table_attachment, alicloud_vpc_route_entry, alicloud_instance, alicloud_security_group, alicloud_security_group_rule, alicloud_eip_address, alicloud_eip_association, alicloud_vpc_peer_connection

Data Sources: alicloud_zones

In this example, the VPCs in the peering connection belong to the same account. When you create a cross-account peering connection, you must also create an alicloud_vpc_peer_connection_accepter to ensure that the peer account accepts the VPC peering connection request.

# Specify the region where you want to create the IPv4 gateway.
provider "alicloud" {
  region = "cn-hangzhou"
}

# Automatically obtain the list of zones where vSwitches can be created based on the data source.
data "alicloud_zones" "available_zones" {
  available_resource_creation = "VSwitch" # Query the zones where resources can be created in the VPC.
}

# Specify the instance type.
variable "instance_type" {
  default = "ecs.e-c1m1.large"
}

# Specify the image ID.
variable "image_id" {
  default = "aliyun_3_x64_20G_alibase_20221102.vhd"
}

# Create a VPC.
resource "alicloud_vpc" "example_vpc1" {
  vpc_name   = "example_vpc1_name"
  cidr_block = "10.0.0.0/16" # Specify the CIDR block. 
}

# Create a VPC.
resource "alicloud_vpc" "example_vpc2" {
  vpc_name   = "example_vpc2_name"
  cidr_block = "30.0.0.0/16" # Specify the CIDR block. 
}

# Create a vSwitch.
resource "alicloud_vswitch" "example_vsw1" {
  vswitch_name = "example_vsw1_name"
  cidr_block   = "10.0.1.0/24"
  vpc_id       = alicloud_vpc.example_vpc1.id
  zone_id      = data.alicloud_zones.available_zones.zones.0.id
}

# Create a vSwitch.
resource "alicloud_vswitch" "example_vsw2" {
  vswitch_name = "example_vsw2_name"
  cidr_block   = "30.0.1.0/24"
  vpc_id       = alicloud_vpc.example_vpc2.id
  zone_id      = data.alicloud_zones.available_zones.zones.1.id
}

# Create a security group.
resource "alicloud_security_group" "example_security_group1" {
  security_group_name = "example_security_group1_name"
  vpc_id              = alicloud_vpc.example_vpc1.id
}

# Create a security group rule. Modify the protocol and port number as needed.
resource "alicloud_security_group_rule" "allow_Internet1" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group1.id
  cidr_ip           = "0.0.0.0/0"
}

# Create a security group.
resource "alicloud_security_group" "example_security_group2" {
  security_group_name = "example_security_group2_name"
  vpc_id              = alicloud_vpc.example_vpc2.id
}

# Create a security group rule. Modify the protocol and port number as needed.
resource "alicloud_security_group_rule" "allow_Internet2" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group2.id
  cidr_ip           = "0.0.0.0/0"
}

# Create an ECS instance.
resource "alicloud_instance" "example_instance1" {
  instance_name        = "example_instance1_name"
  vswitch_id           = alicloud_vswitch.example_vsw1.id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group1.id]
  instance_charge_type = "PostPaid"
  spot_strategy        = "SpotWithPriceLimit"
}

# Create an EIP.
resource "alicloud_eip_address" "example_eip" {
  address_name = "example_eip_name"
  isp          = "BGP"
  netmode      = "public"
  bandwidth    = "1"
  payment_type = "PayAsYouGo"
}

# Associate the ECS instance with an EIP.
resource "alicloud_eip_association" "example_eip_ecs_association" {
  allocation_id = alicloud_eip_address.example_eip.id
  instance_type = "EcsInstance"
  instance_id   = alicloud_instance.example_instance1.id
}

# Create an ECS instance.
resource "alicloud_instance" "example_instance2" {
  instance_name        = "example_instance2_name"
  vswitch_id           = alicloud_vswitch.example_vsw2.id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group2.id]
  instance_charge_type = "PostPaid"
  spot_strategy        = "SpotWithPriceLimit"
}

# Create a custom route table.
resource "alicloud_route_table" "example_route_table1" {
  route_table_name = "example_route_table1_name"
  vpc_id           = alicloud_vpc.example_vpc1.id
}

# Associate the route table with the vSwitch.
resource "alicloud_route_table_attachment" "example_route_table_attachment1" {
  vswitch_id     = alicloud_vswitch.example_vsw1.id
  route_table_id = alicloud_route_table.example_route_table1.id
}

# Create a custom route table.
resource "alicloud_route_table" "example_route_table2" {
  route_table_name = "example_route_table2_name"
  vpc_id           = alicloud_vpc.example_vpc2.id
}

# Associate the route table with the vSwitch.
resource "alicloud_route_table_attachment" "example_route_table_attachment2" {
  vswitch_id     = alicloud_vswitch.example_vsw2.id
  route_table_id = alicloud_route_table.example_route_table2.id
}

# Create a VPC peering connection.
resource "alicloud_vpc_peer_connection" "example_vpc_peer" {
  peer_connection_name = "example_vpc_peer_name"
  vpc_id               = alicloud_vpc.example_vpc1.id
  accepting_ali_uid    = "1234****" # The ID of the account to which the peer VPC belongs. In this example, a same-account VPC peering connection is created. If you create a cross-account peering connection, you must create an alicloud_vpc_peer_connection_accepter to make sure that the peer account accepts the VPC peering connection request.
  accepting_region_id  = "cn-hangzhou"
  accepting_vpc_id     = alicloud_vpc.example_vpc2.id
}

# Configure a route for the peering connection.
resource "alicloud_route_entry" "example_peer_route1" {
  route_table_id        = alicloud_route_table.example_route_table1.id
  destination_cidrblock = "30.0.0.0/16"
  nexthop_type          = "VpcPeer"
  nexthop_id            = alicloud_vpc_peer_connection.example_vpc_peer.id
}

# Configure a route for the peering connection.
resource "alicloud_route_entry" "example_peer_route2" {
  route_table_id        = alicloud_route_table.example_route_table2.id
  destination_cidrblock = "10.0.0.0/16"
  nexthop_type          = "VpcPeer"
  nexthop_id            = alicloud_vpc_peer_connection.example_vpc_peer.id
}

# Create an IPv4 gateway.
resource "alicloud_vpc_ipv4_gateway" "example_ipv4gw" {
  ipv4_gateway_name = "example_ipv4gw_name"
  vpc_id            = alicloud_vpc.example_vpc1.id
  enabled           = true
}

# Add a route that points to the IPv4 gateway.
resource "alicloud_route_entry" "example_igw_route" {
  route_table_id        = alicloud_route_table.example_route_table1.id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

Console

API

• Call AssociateRouteTableWithGateway to attach a gateway route table.

• Call DissociateRouteTableFromGateway to detach a gateway route table.

Terraform

Resource: alicloud_vpc_gateway_route_table_attachment

# Specify the region where the IPv4 gateway is deployed.
provider "alicloud" {
  region = "cn-hangzhou"
}

# Specify the ID of the IPv4 gateway.
variable "ipv4_gateway_id" {
  default = "ipv4gw-hp3v******" # Replace the value with the actual ID of the IPv4 gateway.
}

# Specify the ID of the gateway route table.
variable "route_table_id" {
  default = "vtb-hp3w******" # Replace the value with the actual ID of the gateway route table.
}

# Attach the gateway route table.
resource "alicloud_vpc_gateway_route_table_attachment" "example_attachment" {
  ipv4_gateway_id = var.ipv4_gateway_id
  route_table_id  = var.route_table_id
}