The billable items for IPsec-VPN vary by binding mode.
Binding modes and billing
IPsec-VPN binding mode | Billable item | Billing method | Associated product |
enhanced VPN gateway | IPsec connection fee, public network traffic fee | pay-as-you-go | VPN Gateway, Cloud Data Transfer |
standard VPN gateway | IPsec connection fee, traffic fee | pay-as-you-go | VPN Gateway |
Transit Router | IPsec connection fee, public network traffic fee, Transit Router connection fee, Transit Router traffic processing fee | pay-as-you-go | VPN Gateway, Cloud Data Transfer, Cloud Enterprise Network |
To compare binding modes, see Choose a binding mode.
Enhanced VPN gateway
Billing items
Pricing for an enhanced VPN gateway is based on IPsec-VPN connections. You are charged an IPsec-VPN connection fee and a data transfer fee:
Billing item | Unit price | Billing method | Description |
IPsec-VPN connection fee | USD 0.1/connection/hour | pay-as-you-go | You are charged on an hourly basis for each IPsec-VPN connection. Usage is rounded up to the nearest hour. This fee is currently not charged. You will be notified separately before formal billing begins. |
data transfer fee | pay-as-you-go | Only outbound traffic is charged. This fee applies to the BGP (Multi-ISP) line type and is billed by Cloud Data Transfer. Cloud Data Transfer provides a monthly free tier of 220 GB (20 GB for regions in mainland China and 200 GB for other regions). |
Examples
Suppose you create two IPsec-VPN connections for an enhanced VPN gateway in the Singapore region. Over 24 hours, these connections transfer 500 GB of data to Alibaba Cloud and 250 GB from Alibaba Cloud. The fees are calculated as follows:
IPsec-VPN connection fee = USD 0.1/connection/hour × 24 hours × 2 IPsec-VPN connections = USD 4.80
data transfer fee (outbound traffic only) = USD 0.1/GB × (250 - 200) GB = USD 5.00 (Cloud Data Transfer provides a monthly free tier of 200 GB for outbound traffic for regions outside mainland China.)
Total cost = IPsec-VPN connection fee + data transfer fee = USD 9.80
Standard VPN gateway
Billing items
Pricing for a standard VPN gateway is based on the VPN gateway instance. If you enable only the IPsec feature, you incur an IPsec-VPN instance fee and a bandwidth fee:
Billing item | Unit price | Billing method | Description |
IPsec-VPN instance fee | pay-as-you-go | For instance fees, if your usage duration is less than 1 hour, you will be charged for 1 hour. | |
Data transfer fee |
If you also enable the SSL-VPN feature, you will incur an additional SSL-VPN instance fee and an SSL specification fee. For details, see SSL-VPN billing.
Instance and data transfer pricing
The IPsec-VPN instance fee and or traffic fee for a standard VPN gateway depend on the bandwidth specification and region selected upon purchase:
Instance fee
Unit: USD/hour.
Region | 10 Mbps | 100 Mbps | 200 Mbps | 500 Mbps | 1000 Mbps |
The Chinese mainland | 0.059 | 0.209 | 0.209 | 0.767 | 0.767 |
China (Hong Kong) | 0.087 | 0.262 | 0.262 | 1.025 | 1.025 |
Singapore | 0.087 | 0.262 | 0.262 | 1.025 | 1.025 |
Japan (Tokyo) | 0.091 | 0.275 | 0.275 | 0.767 | 0.767 |
South Korea (Seoul) | 0.091 | 0.275 | 0.275 | 0.767 | 0.767 |
Thailand (Bangkok) | 0.087 | 0.262 | 0.262 | 1.025 | 1.025 |
Philippines (Manila) | 0.087 | 0.262 | 0.262 | 1.025 | 1.025 |
Malaysia (Kuala Lumpur) | 0.080 | 0.240 | 0.240 | 0.878 | 0.878 |
Indonesia (Jakarta) | 0.086 | 0.262 | 0.262 | 0.734 | 0.734 |
US (Virginia) | 0.066 | 0.295 | 0.295 | 0.826 | 0.826 |
US (Silicon Valley) | 0.082 | 0.392 | 0.392 | 1.095 | 1.095 |
Germany (Frankfurt) | 0.077 | 0.359 | 0.359 | 1.003 | 1.003 |
UK (London) | 0.077 | 0.359 | 0.359 | 1.003 | 1.003 |
Mexico | 0.066 | 0.295 | 0.295 | 0.826 | 0.826 |
UAE (Dubai) | 0.090 | 0.420 | 0.420 | 1.231 | Not supported |
SAU (Riyadh - Partner Region) | 0.104 | 0.314 | 0.314 | 1.230 | Not supported |
Traffic fee
Billed only for egress traffic. Unit: USD/GB.
Region | Unit price |
The Chinese mainland | 0.125 |
China (Hong Kong) | 0.153 |
Singapore | 0.117 |
Japan (Tokyo) | 0.120 |
South Korea (Seoul) | 0.125 |
Thailand (Bangkok) | 0.117 |
Philippines (Manila) | 0.110 |
Malaysia (Kuala Lumpur) | 0.125 |
Indonesia (Jakarta) | 0.110 |
US (Virginia) | 0.078 |
US (Silicon Valley) | 0.078 |
Germany (Frankfurt) | 0.070 |
UK (London) | 0.070 |
Mexico | 0.078 |
UAE (Dubai) | 0.447 |
SAU (Riyadh - Partner Region) | 0.140 |
China (Nanjing) (decommissioning)The maximum bandwidth specification supports up to 500 Mbps.The prices listed above are only for public cloud regions. If there is any inconsistency with purchase page, the Buy page shall prevail.
Examples
Suppose an enterprise uses a standard VPN gateway in the China (Hangzhou) region to connect an IDC to Alibaba Cloud, with only the IPsec-VPN feature enabled. In 24 hours, 20 GB of data is transferred from the IDC to Alibaba Cloud and 10 GB from Alibaba Cloud to the IDC. The fees are calculated as follows:
IPsec-VPN instance fee: USD 0.059/hour × 24 hours = USD 1.416
Data transfer fee: USD 0.125/GB × 10 GB = USD 1.25
Total cost = IPsec-VPN instance fee + Data transfer fee = USD 2.666
Binding to a transit router
Billable items
You are charged for each ipsec-vpn connection bound to a Transit Router.
Billable item | Unit price | Description |
IPsec-VPN connection instance fee |
Important The 3 Gbps tunnel bandwidth (Large) feature is in public beta. To use this feature, contact your account manager to apply. | This fee is charged hourly per ipsec-vpn connection. Partial hours are billed as full hours. |
Public network traffic fee | See CDT Pricing | Billing applies only to outbound traffic. |
TR connection fee | Charged by CEN. For more information, see CEN billing. | |
TR traffic processing fee | ||
Notes:
Public network traffic fees do not apply to private ipsec-vpn connections.
After you bind an ipsec-vpn connection to a Transit Router, you cannot change the bound resource type or the billing method.
A single ipsec-vpn connection supports a maximum tunnel bandwidth of 1 Gbps or 3 Gbps. This bandwidth specification cannot be changed. To increase the bandwidth between your on-premises data center and the cloud, you can establish multiple ipsec-vpn connections.
The 3 Gbps tunnel bandwidth (Large) feature is in public beta. To use this feature, contact your account manager to apply.
TR connection fee and TR traffic processing fee are two different dimensions of billing items: TR connection fee is an instance retention fee (that is, the instance retention duration fee), charged based on the retention duration after the IPsec connection is created, and is unrelated to the actual traffic; TR traffic processing fee is calculated separately based on the actual traffic used. For details, see CEN billing.
Examples
An on-premises data center connects to a Transit Router in the Singapore region through one public ipsec-vpn connection to communicate with a VPC. Over a 24-hour period, the inbound traffic is 50 GB and the outbound traffic is 200 GB. The fees for the ipsec-vpn connection during this period are calculated as follows:
IPsec connection instance fee = USD 0.05/connection/hour × 24 hours × 1 IPsec connection = USD 1.20
Public network traffic fee (outbound only) = USD 0.125/GB × (200 - 200) GB = USD 0.00 (For regions outside the Chinese mainland, CDT provides a monthly free tier of 200 GB.)
TR connection fee = USD 0.05/connection/hour × 24 hours × 1 IPsec connection = USD 1.20
TR traffic processing fee (inbound to TR only) = USD 0.02/GB × 50 GB = USD 1.00
Total cost = IPsec connection instance fee + traffic fee + TR connection fee + TR traffic processing fee = USD 3.40
View bills
Go to the Billing & Cost Management console to view billing details.
Internet traffic fees are billed under Cloud Data Transfer (CDT).
For bound transit routers, the TR connection fee and TR data processing fee are billed under Cloud Enterprise Network (CEN).
Documentation
FAQ
Mainland China regions
China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Nanjing) (Local Region) (decommissioning), China (Shenzhen), China (Heyuan), China (Guangzhou), and China (Chengdu).
Does IPsec-VPN support free trials or free connectivity plans?
Alibaba Cloud IPsec-VPN does not support free trials and must be purchased separately. For low-cost testing and verification, we recommend that you choose Enhanced IPsec-VPN (pay-as-you-go) for testing, and release the resources after testing.
Does transferring data such as OSS through ECS via the VPN gateway to an on-premises data center incur additional traffic fees?
The ECS side itself does not incur additional VPN traffic fees. The VPN gateway side is billed normally based on the attachment mode:
Enhanced IPsec-VPN: Pay-as-you-go, charging IPsec connection fee and egress direction Public network traffic fee.
Standard VPN Gateway: Pay-as-you-go, charging IPsec-VPN instance fee and egress direction Traffic fee.
IPsec-VPN attached to Enterprise Transit Router: Pay-as-you-go, charging TR connection fee, Traffic forwarding fee, IPsec connection instance fee, and egress direction Public network traffic fee.
For specific billing rules, see each Billing item in this topic.
If I selected the wrong VPC when creating the VPN gateway, how do I change the attached VPC?
VPN gateways do not support directly changing or modifying an already attached VPC. To use a different VPC, unsubscribe from the current VPN gateway instance and purchase a new one, selecting the correct VPC. For details about the unsubscribe operation, see overdue payments and refunds.
Will the public IP address change after I unsubscribe and create a new VPN gateway?
Yes, it will change. The newly created VPN gateway will be assigned a new public IP address, and the original public IP address cannot be retained. Therefore, if you need to rebuild the VPN gateway because you selected the wrong VPC, or you need to purchase a new VPN gateway to change the VPC, please be aware of this change and promptly update the peer public IP address configured on the local device (such as a firewall or router) to avoid IPsec connection interruptions.