All Products
Search

This Product

    VPN Gateway:Billing

    Document Center

    VPN Gateway:Billing

    Last Updated:Aug 26, 2026

    The billable items for IPsec-VPN vary by binding mode.

    Binding modes and billing

    IPsec-VPN binding mode

    Billable item

    Billing method

    Associated product

    enhanced VPN gateway

    IPsec connection fee, public network traffic fee

    pay-as-you-go

    VPN Gateway, Cloud Data Transfer

    standard VPN gateway

    IPsec connection fee, traffic fee

    pay-as-you-go

    VPN Gateway

    Transit Router

    IPsec connection fee, public network traffic fee, Transit Router connection fee, Transit Router traffic processing fee

    pay-as-you-go

    VPN Gateway, Cloud Data Transfer, Cloud Enterprise Network

    To compare binding modes, see Choose a binding mode.

    Enhanced VPN gateway

    Billing items

    Pricing for an enhanced VPN gateway is based on IPsec-VPN connections. You are charged an IPsec-VPN connection fee and a data transfer fee:

    Billing item

    Unit price

    Billing method

    Description

    IPsec-VPN connection fee

    USD 0.1/connection/hour

    pay-as-you-go

    You are charged on an hourly basis for each IPsec-VPN connection. Usage is rounded up to the nearest hour.

    This fee is currently not charged. You will be notified separately before formal billing begins.

    data transfer fee

    See Cloud Data Transfer pricing

    pay-as-you-go

    Only outbound traffic is charged. This fee applies to the BGP (Multi-ISP) line type and is billed by Cloud Data Transfer. Cloud Data Transfer provides a monthly free tier of 220 GB (20 GB for regions in mainland China and 200 GB for other regions).

    Examples

    Suppose you create two IPsec-VPN connections for an enhanced VPN gateway in the Singapore region. Over 24 hours, these connections transfer 500 GB of data to Alibaba Cloud and 250 GB from Alibaba Cloud. The fees are calculated as follows:

    • IPsec-VPN connection fee = USD 0.1/connection/hour × 24 hours × 2 IPsec-VPN connections = USD 4.80

    • data transfer fee (outbound traffic only) = USD 0.1/GB × (250 - 200) GB = USD 5.00 (Cloud Data Transfer provides a monthly free tier of 200 GB for outbound traffic for regions outside mainland China.)

    • Total cost = IPsec-VPN connection fee + data transfer fee = USD 9.80

    Standard VPN gateway

    Billing items

    Pricing for a standard VPN gateway is based on the VPN gateway instance. If you enable only the IPsec feature, you incur an IPsec-VPN instance fee and a bandwidth fee:

    Billing item

    Unit price

    Billing method

    Description

    IPsec-VPN instance fee

    See Instance fee and data transfer fee pricing.

    pay-as-you-go

    For instance fees, if your usage duration is less than 1 hour, you will be charged for 1 hour.

    Data transfer fee

    If you also enable the SSL-VPN feature, you will incur an additional SSL-VPN instance fee and an SSL specification fee. For details, see SSL-VPN billing.

    Instance and data transfer pricing

    The IPsec-VPN instance fee and or traffic fee for a standard VPN gateway depend on the bandwidth specification and region selected upon purchase:

    Instance fee

    Unit: USD/hour.

    Region

    10 Mbps

    100 Mbps

    200 Mbps

    500 Mbps

    1000 Mbps

    The Chinese mainland

    0.059

    0.209

    0.209

    0.767

    0.767

    China (Hong Kong)

    0.087

    0.262

    0.262

    1.025

    1.025

    Singapore

    0.087

    0.262

    0.262

    1.025

    1.025

    Japan (Tokyo)

    0.091

    0.275

    0.275

    0.767

    0.767

    South Korea (Seoul)

    0.091

    0.275

    0.275

    0.767

    0.767

    Thailand (Bangkok)

    0.087

    0.262

    0.262

    1.025

    1.025

    Philippines (Manila)

    0.087

    0.262

    0.262

    1.025

    1.025

    Malaysia (Kuala Lumpur)

    0.080

    0.240

    0.240

    0.878

    0.878

    Indonesia (Jakarta)

    0.086

    0.262

    0.262

    0.734

    0.734

    US (Virginia)

    0.066

    0.295

    0.295

    0.826

    0.826

    US (Silicon Valley)

    0.082

    0.392

    0.392

    1.095

    1.095

    Germany (Frankfurt)

    0.077

    0.359

    0.359

    1.003

    1.003

    UK (London)

    0.077

    0.359

    0.359

    1.003

    1.003

    Mexico

    0.066

    0.295

    0.295

    0.826

    0.826

    UAE (Dubai)

    0.090

    0.420

    0.420

    1.231

    Not supported

    SAU (Riyadh - Partner Region)

    0.104

    0.314

    0.314

    1.230

    Not supported

    Traffic fee

    Unit: USD/GB.

    Region

    Unit price

    The Chinese mainland

    0.125

    China (Hong Kong)

    0.153

    Singapore

    0.117

    Japan (Tokyo)

    0.120

    South Korea (Seoul)

    0.125

    Thailand (Bangkok)

    0.117

    Philippines (Manila)

    0.110

    Malaysia (Kuala Lumpur)

    0.125

    Indonesia (Jakarta)

    0.110

    US (Virginia)

    0.078

    US (Silicon Valley)

    0.078

    Germany (Frankfurt)

    0.070

    UK (London)

    0.070

    Mexico

    0.078

    UAE (Dubai)

    0.447

    SAU (Riyadh - Partner Region)

    0.140

    Important

    • These prices apply only to public cloud regions. In case of any discrepancy with the purchase page, the prices shown there prevail.

    • China (Nanjing) (decommissioning) support a maximum of 500 Mbps.

    Examples

    Suppose an enterprise uses a standard VPN gateway in the China (Hangzhou) region to connect an IDC to Alibaba Cloud, with only the IPsec-VPN feature enabled. In 24 hours, 20 GB of data is transferred from the IDC to Alibaba Cloud and 10 GB from Alibaba Cloud to the IDC. The fees are calculated as follows:

    • IPsec-VPN instance fee: USD 0.059/hour × 24 hours = USD 1.416

    • Data transfer fee: USD 0.125/GB × 10 GB = USD 1.25

    • Total cost = IPsec-VPN instance fee + Data transfer fee = USD 2.666

    Binding to a transit router

    Billable items

    You are charged for each ipsec-vpn connection bound to a Transit Router.

    Billable item

    Unit price

    Description

    IPsec-VPN connection instance fee

    • Tunnel bandwidth of 1 Gbps (Standard):

      • "United Arab Emirates (Dubai), SAU (Riyadh - Partner Region)" region USD 0.06/connection/hour.

      • For other regions: USD 0.05/connection/hour.

    • Tunnel bandwidth of 3 Gbps (Large):

      • "United Arab Emirates (Dubai), SAU (Riyadh - Partner Region)" region USD 0.6/connection/hour.

      • For other regions: USD 0.5/connection/hour.

    Important

    The 3 Gbps tunnel bandwidth (Large) feature is in public beta. To use this feature, contact your account manager to apply.

    This fee is charged hourly per ipsec-vpn connection. Partial hours are billed as full hours.

    Public network traffic fee

    See CDT Pricing

    Billing applies only to outbound traffic.

    TR connection fee

    • The Chinese mainland: USD 0.05/connection/hour.

    • Outside the Chinese mainland: USD 0.06/connection/hour.

    Charged by CEN. For more information, see CEN billing.

    TR traffic processing fee

    USD 0.02/GB.

    Notes:

    • Public network traffic fees do not apply to private ipsec-vpn connections.

    • After you bind an ipsec-vpn connection to a Transit Router, you cannot change the bound resource type or the billing method.

    • A single ipsec-vpn connection supports a maximum tunnel bandwidth of 1 Gbps or 3 Gbps. This bandwidth specification cannot be changed. To increase the bandwidth between your on-premises data center and the cloud, you can establish multiple ipsec-vpn connections.

      The 3 Gbps tunnel bandwidth (Large) feature is in public beta. To use this feature, contact your account manager to apply.

    • TR connection fee and TR traffic processing fee are two different dimensions of billing items: TR connection fee is an instance retention fee (that is, the instance retention duration fee), charged based on the retention duration after the IPsec connection is created, and is unrelated to the actual traffic; TR traffic processing fee is calculated separately based on the actual traffic used. For details, see CEN billing.

    Examples

    An on-premises data center connects to a Transit Router in the Singapore region through one public ipsec-vpn connection to communicate with a VPC. Over a 24-hour period, the inbound traffic is 50 GB and the outbound traffic is 200 GB. The fees for the ipsec-vpn connection during this period are calculated as follows:

    • IPsec connection instance fee = USD 0.05/connection/hour × 24 hours × 1 IPsec connection = USD 1.20

    • Public network traffic fee (outbound only) = USD 0.125/GB × (200 - 200) GB = USD 0.00 (For regions outside the Chinese mainland, CDT provides a monthly free tier of 200 GB.)

    • TR connection fee = USD 0.05/connection/hour × 24 hours × 1 IPsec connection = USD 1.20

    • TR traffic processing fee (inbound to TR only) = USD 0.02/GB × 50 GB = USD 1.00

    • Total cost = IPsec connection instance fee + traffic fee + TR connection fee + TR traffic processing fee = USD 3.40

    View bills

    • Go to the Billing & Cost Management console to view billing details.

    • Internet traffic fees are billed under Cloud Data Transfer (CDT).

    • For bound transit routers, the TR connection fee and TR data processing fee are billed under Cloud Enterprise Network (CEN).

    Documentation

    FAQ

    Mainland China regions

    China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Nanjing) (Local Region) (decommissioning), China (Shenzhen), China (Heyuan), China (Guangzhou), and China (Chengdu).

    Does IPsec-VPN support free trials or free connectivity plans?

    Alibaba Cloud IPsec-VPN does not support free trials, nor does it offer free dedicated line or IPsec interconnection services; all solutions must be purchased separately. For low-cost testing and verification, we recommend choosing a lower-configured pay-as-you-go instance (such as Enhanced IPsec-VPN) for testing, and releasing the resources after testing.

    Does transferring data such as OSS through ECS via the VPN gateway to an on-premises data center incur additional traffic fees?

    The ECS side itself does not incur additional VPN traffic fees. The VPN gateway side is billed normally based on the attachment mode:

    • Standard VPN Gateway: Billed based on usage, charging IPsec-VPN instance fee and traffic fee.

    • Enhanced IPsec-VPN: Pay-as-you-go, charging IPsec connection fee and the outbound direction public network traffic fee.

    • attach to Transit Router: Pay-as-you-go, charging IPsec connection instance fee, TR connection fee, TR traffic processing fee, and the outbound direction public network traffic fee.

    Note that only traffic in the outbound direction (the direction from Alibaba Cloud to the on-premises data center) incurs a public network traffic fee; traffic in the inbound direction (the direction from the on-premises data center to Alibaba Cloud) is free.

    If I selected the wrong VPC when creating the VPN gateway, how do I change the attached VPC?

    VPN gateways do not support directly changing or modifying an already attached VPC. To use a different VPC, unsubscribe from the current VPN gateway instance and purchase a new one, selecting the correct VPC. For details about the unsubscribe operation, see overdue payments and refunds.

    Will the public IP address change after I unsubscribe and create a new VPN gateway?

    Yes, it will change. The newly created VPN gateway will be assigned a new public IP address, and the original public IP address cannot be retained. Therefore, if you need to rebuild the VPN gateway because you selected the wrong VPC, or you need to purchase a new VPN gateway to change the VPC, please be aware of this change and promptly update the peer public IP address configured on the local device (such as a firewall or router) to avoid IPsec connection interruptions.