VPN Gateway allows you to create SSL-VPN and IPsec-VPN connections. Each type of connection can be associated with different resources and involves different billable items. This topic describes the billing rules for SSL-VPN and IPsec-VPN.
Billing rules
Billing rules for SSL-VPN
Resource associated with an SSL server | Feature enabled for a VPN gateway | Billable item | Billing method | Billing cycle |
VPN gateway | SSL-VPN |
| Pay-as-you-go This billing method allows you to use resources and pay for them afterwards. You are billed based on the resources that are consumed. | 1 hour. If the usage duration is less than an hour, it is rounded up to 1 hour. |
SSL-VPN and IPsec-VPN |
|
Billing rules for IPsec-VPN
Resource associated with an IPsec-VPN connection | Feature enabled for a VPN gateway | Network type of IPsec-VPN connection | Billable item | Billing method | Billing cycle |
VPN gateway | IPsec-VPN | N/A |
| Pay-as-you-go. This billing method allows you to use resources and pay for them afterwards. You are billed based on the resources that are consumed. | 1 hour. If the usage duration is less than an hour, it is rounded up to 1 hour. |
SSL-VPN and IPsec-VPN |
| ||||
Transit router | N/A | Public |
| ||
Private |
|
In the following scenario in which an IPsec-VPN connection is associated with a transit router, only the IPsec-VPN connection fee and the data transfer fee are described. For more information about the transit router connection fee, transit router data transfer fee, and outbound data transfer fee of Express Connect, see Billing rules and Outbound data transfer fees.
Billable items
The price information listed in this topic is for reference only. The prices on the buy page shall prevail.
The maximum bandwidth supported by VPN gateways in the China (Nanjing - Local Region) region is 200 Mbit/s.
In the following table, N/A indicates that the bandwidth value is not supported by VPN gateways in the corresponding region.
IPsec-VPN and SSL-VPN instance fees
VPN gateways provide different bandwidth specifications. When the same bandwidth specification is used in the same region, the instance unit prices for IPsec-VPN and SSL-VPN are the same. The following table lists the unit prices. Unit: USD/hour.
Region | 10 Mbps | 100 Mbps | 200 Mbps | 500 Mbps | 1000 Mbps |
Chinese mainland | 0.059 | 0.209 | 0.209 | 0.767 | 0.767 |
China (Hong Kong) | 0.087 | 0.262 | 0.262 | 1.025 | 1.025 |
Singapore | 0.087 | 0.262 | 0.262 | 1.025 | 1.025 |
Japan (Tokyo) | 0.091 | 0.275 | 0.275 | 0.767 | 0.767 |
South Korea (Seoul) | 0.091 | 0.275 | 0.275 | Not supported | Not supported |
Thailand (Bangkok) | 0.087 | 0.262 | 0.262 | Not supported | Not supported |
Philippines (Manila) | 0.087 | 0.262 | 0.262 | Not supported | Not supported |
Malaysia (Kuala Lumpur) | 0.080 | 0.240 | 0.240 | 0.878 | 0.878 |
India (Mumbai) | 0.082 | 0.249 | 0.249 | Not supported | Not supported |
Indonesia (Jakarta) | 0.087 | 0.262 | 0.262 | 0.734 | 0.734 |
Australia (Sydney) | 0.087 | 0.389 | 0.389 | Not supported | Not supported |
US (Virginia) | 0.066 | 0.295 | 0.295 | 0.826 | 0.826 |
US (Silicon Valley) | 0.082 | 0.392 | 0.392 | Not supported | Not supported |
Germany (Frankfurt) | 0.077 | 0.359 | 0.359 | 1.003 | 1.003 |
UK (London) | 0.077 | 0.359 | 0.359 | 1.003 | 1.003 |
UAE (Dubai) | 0.090 | 0.420 | 0.420 | Not supported | Not supported |
IPsec-VPN connection
The unit price of IPsec-VPN connections is USD 0.05/hour per connection.
Data transfer
You are charged for data transfer from Alibaba Cloud to a data center over an IPsec-VPN connection. You are not charged for data transfer from a data center to Alibaba Cloud over an IPsec-VPN connection. Unit: USD/GB.
Region | Unit price |
Chinese mainland | 0.125 |
China (Hong Kong) | 0.153 |
Singapore | 0.117 |
Japan (Tokyo) | 0.120 |
South Korea (Seoul) | 0.125 |
Thailand (Bangkok) | 0.117 |
Philippines (Manila) | 0.010 |
Malaysia (Kuala Lumpur) | 0.125 |
India (Mumbai) | 0.117 |
Indonesia (Jakarta) | 0.090 |
Australia (Sydney) | 0.096 |
US (Virginia) | 0.078 |
US (Silicon Valley) | 0.078 |
Germany (Frankfurt) | 0.070 |
UK (London) | 0.070 |
UAE (Dubai) | 0.447 |
SSL specification
After the SSL-VPN feature is enabled, you must select an SSL specification based on the number of clients that you want to connect at a time. The following table lists the unit prices for different SSL specifications. Unit: USD/hour.
SSL connections | Unit price |
5 | 0.048 |
10 | 0.074 |
20 | 0.117 |
50 | 0.226 |
100 | 0.328 |
500 | 1.090 |
1000 | 1.547 |
Billing example
You can associate IPsec-VPN and SSL-VPN connections with different resources, and the billable items vary based on the associated resource. In one of the following scenarios, an IPsec-VPN connection and an SSL-VPN connection are associated with the same VPN gateway. In the other scenario, an IPsec-VPN connection is associated with a transit router.
Connections associated with a VPN gateway

As shown in the preceding figure, a data center in the Chinese mainland has Office 1 and Office 2. Office 1 communicates with a virtual private cloud (VPC) through IPsec-VPN, and the clients of Office 2 communicate with the VPC through SSL-VPN. In this example, the IPsec-VPN connection and the SSL server are associated with the same VPN gateway. The bandwidth specification of the VPN gateway is 10 Mbit/s. The data transfer from the VPN gateway to Office 1 and Office 2 is 10 GB. The VPN gateway supports a maximum of five SSL-VPN connections. During the 24 hours from 00:00:00 (UTC+8) on June 1, 2022 to 00:00:00 (UTC+8) on June 2, 2022, the total fee can be calculated by using the following formula:
IPsec-VPN instance fee = USD 0.059/hour × 24 hours = USD 1.416
SSL-VPN instance fee = USD 0.059/hour × 24 hours = USD 1.416
SSL specification fee = USD 0.048/hour × 24 hours = USD 1.152
Data transfer fee = USD 0.125/GB × 10 GB = USD 1.25
Total fee= IPsec-VPN instance fee + SSL-VPN instance fee + SSL specification fee + Data transfer fee = USD 5.234
Connections associated with a transit router

As shown in the preceding figure, a data center in the Chinese mainland is connected to a transit router through a public IPsec-VPN connection. Then, the data center can communicate with a VPC. In this example, the data transfer from the data center to the transit router is 5 GB. The data transfer from the transit router to the data center is 10 GB. During the 24 hours from 00:00:00 (UTC+8) on June 1, 2022 to 00:00:00 (UTC+8) on June 2, 2022, the total fee can be calculated by using the following formula:
IPsec-VPN connection fee = USD 0.05/connection/hour × 24 hours × 1 connection = USD 1.2
Data transfer fee = USD 0.125/GB × 10 GB = USD 1.25
Transit router connection fee = USD 0.05/connection/hour × 24 hours × 1 connection = USD 1.2
Transit router traffic processing fee = USD 0.02/GB × 5 GB = USD 0.1
Total fee = IPsec-VPN connection fee + Data transfer fee + Transit router connection fee + Transit router traffic processing fee = USD 3.75
Overdue payments
Overdue payments of VPN gateways
If a VPN gateway with which IPsec-VPN connections and SSL servers are associated has an overdue payment, the following rules apply:
The VPN gateway can continue to provide services within 15 days after the payment becomes overdue. To ensure that your services run as expected, top up your account at the earliest opportunity.
If you do not complete the payment within 15 days after the payment becomes overdue, the VPN gateway is suspended.
If you top up your account after the VPN gateway is suspended, the system automatically pays the outstanding amount. Then, the VPN gateway immediately starts to provide services.
If you do not complete the payment within 15 days after the VPN gateway is suspended, the system automatically releases the VPN gateway.
You are notified by text message and email one day before the system releases the VPN gateway. After the VPN gateway is released, the configurations and related data are deleted and cannot be restored.
Overdue payments of IPsec-VPN connections
If an IPsec-VPN connection that is associated with a transit router has an overdue payment, the following rules apply:
The IPsec-VPN connection can continue to provide services within 15 days after the payment becomes overdue. To ensure that your services run as expected, top up your account at the earliest opportunity.
If you do not complete the payment within 15 days after the payment becomes overdue, the IPsec-VPN connection is suspended.
If you top up your account after the IPsec-VPN connection is suspended, the system automatically pays the outstanding amount. Then, the IPsec-VPN connection immediately starts to provide services.
If you do not complete the payment within 15 days after the IPsec-VPN connection is suspended, the system automatically releases the IPsec-VPN connection.
You are notified by text message and email one day before the system releases the IPsec-VPN connection. After the IPsec-VPN connection is released, the configurations and related data are deleted and cannot be restored.