All Products
Search

This Product

    VPN Gateway:Billing

    Document Center

    VPN Gateway:Billing

    Last Updated:Jun 30, 2026

    The billable items for IPsec-VPN vary by binding mode.

    Binding modes and billing

    IPsec-VPN binding mode

    Billable item

    Billing method

    Associated product

    enhanced VPN gateway

    IPsec connection fee, public network traffic fee

    pay-as-you-go

    VPN Gateway, Cloud Data Transfer

    standard VPN gateway

    IPsec connection fee, traffic fee

    pay-as-you-go

    VPN Gateway

    Transit Router

    IPsec connection fee, public network traffic fee, Transit Router connection fee, Transit Router traffic processing fee

    pay-as-you-go

    VPN Gateway, Cloud Data Transfer, Cloud Enterprise Network

    To compare binding modes, see Select a binding mode.

    Enhanced VPN gateway

    Billing items

    Pricing for an enhanced VPN gateway is based on IPsec-VPN connections. You are charged an IPsec-VPN connection fee and a data transfer fee:

    Billing item

    Unit price

    Billing method

    Description

    IPsec-VPN connection fee

    USD 0.1/connection/hour

    pay-as-you-go

    You are charged on an hourly basis for each IPsec-VPN connection. Usage is rounded up to the nearest hour.

    data transfer fee

    See Cloud Data Transfer pricing

    pay-as-you-go

    Only outbound traffic is charged. This fee applies to the BGP (Multi-ISP) line type and is billed by Cloud Data Transfer. Cloud Data Transfer provides a monthly free tier of 220 GB (20 GB for regions in mainland China and 200 GB for other regions).

    The enhanced VPN gateway is currently in an invitation-only beta phase. During this phase, the IPsec-VPN connection fee is waived.

    Examples

    Suppose you create two IPsec-VPN connections for an enhanced VPN gateway in the Singapore region. Over 24 hours, these connections transfer 500 GB of data to Alibaba Cloud and 250 GB from Alibaba Cloud. The fees are calculated as follows:

    • IPsec-VPN connection fee = USD 0.1/connection/hour × 24 hours × 2 IPsec-VPN connections = USD 4.80

    • data transfer fee (outbound traffic only) = USD 0.1/GB × (250 - 200) GB = USD 5.00 (Cloud Data Transfer provides a monthly free tier of 200 GB for outbound traffic for regions outside mainland China.)

    • Total cost = IPsec-VPN connection fee + data transfer fee = USD 9.80

    Standard VPN gateway

    Billing items

    Pricing for a standard VPN gateway is based on the VPN gateway instance. If you enable only the IPsec feature, you incur an IPsec-VPN instance fee and a bandwidth fee:

    Billing item

    Unit price

    Billing method

    Description

    IPsec-VPN instance fee

    See Instance fee and data transfer fee pricing.

    Subscription

    The fee is determined by the selected bandwidth specification.

    Data transfer fee

    If you also enable the SSL-VPN feature, you will incur an additional SSL-VPN instance fee and an SSL specification fee. For details, see SSL-VPN billing.

    Instance and data transfer pricing

    The IPsec-VPN instance fee and or traffic fee for a standard VPN gateway depend on the bandwidth specification and region selected upon purchase:

    Instance fee

    Unit: USD/hour.

    Region

    10 Mbps

    100 Mbps

    200 Mbps

    500 Mbps

    1000 Mbps

    The Chinese mainland

    0.059

    0.209

    0.209

    0.767

    0.767

    China (Hong Kong)

    0.087

    0.262

    0.262

    1.025

    1.025

    Singapore

    0.087

    0.262

    0.262

    1.025

    1.025

    Japan (Tokyo)

    0.091

    0.275

    0.275

    0.767

    0.767

    South Korea (Seoul)

    0.091

    0.275

    0.275

    0.767

    0.767

    Thailand (Bangkok)

    0.087

    0.262

    0.262

    1.025

    1.025

    Philippines (Manila)

    0.087

    0.262

    0.262

    1.025

    1.025

    Malaysia (Kuala Lumpur)

    0.080

    0.240

    0.240

    0.878

    0.878

    Indonesia (Jakarta)

    0.086

    0.262

    0.262

    0.734

    0.734

    US (Virginia)

    0.066

    0.295

    0.295

    0.826

    0.826

    US (Silicon Valley)

    0.082

    0.392

    0.392

    1.095

    1.095

    Germany (Frankfurt)

    0.077

    0.359

    0.359

    1.003

    1.003

    UK (London)

    0.077

    0.359

    0.359

    1.003

    1.003

    Mexico

    0.066

    0.295

    0.295

    0.826

    0.826

    UAE (Dubai)

    0.090

    0.420

    0.420

    1.231

    Not supported

    SAU (Riyadh - Partner Region)

    0.104

    0.314

    0.314

    1.230

    Not supported

    Traffic fee

    Unit: USD/GB.

    Region

    Unit price

    The Chinese mainland

    0.125

    China (Hong Kong)

    0.153

    Singapore

    0.117

    Japan (Tokyo)

    0.120

    South Korea (Seoul)

    0.125

    Thailand (Bangkok)

    0.117

    Philippines (Manila)

    0.110

    Malaysia (Kuala Lumpur)

    0.125

    Indonesia (Jakarta)

    0.110

    US (Virginia)

    0.078

    US (Silicon Valley)

    0.078

    Germany (Frankfurt)

    0.070

    UK (London)

    0.070

    Mexico

    0.078

    UAE (Dubai)

    0.447

    SAU (Riyadh - Partner Region)

    0.140

    Important

    • These prices apply only to public cloud regions. In case of any discrepancy with the purchase page, the prices shown there prevail.

    • China (Nanjing) (decommissioning) support a maximum of 500 Mbps.

    Examples

    Suppose an enterprise uses a standard VPN gateway in the China (Hangzhou) region to connect an IDC to Alibaba Cloud, with only the IPsec-VPN feature enabled. In 24 hours, 20 GB of data is transferred from the IDC to Alibaba Cloud and 10 GB from Alibaba Cloud to the IDC. The fees are calculated as follows:

    • IPsec-VPN instance fee: USD 0.059/hour × 24 hours = USD 1.416

    • Data transfer fee: USD 0.125/GB × 10 GB = USD 1.25

    • Total cost = IPsec-VPN instance fee + Data transfer fee = USD 2.666

    Binding to a transit router

    Billable items

    You are charged for each ipsec-vpn connection bound to a Transit Router.

    Billable item

    Unit price

    Description

    IPsec-VPN connection instance fee

    • Tunnel bandwidth of 1 Gbps (Standard):

      • For UAE (Dubai) and Saudi Arabia (Riyadh) - Operated by Partner regions: USD 0.06/connection/hour.

      • For other regions: USD 0.05/connection/hour.

    • Tunnel bandwidth of 3 Gbps (Large):

      • For UAE (Dubai) and Saudi Arabia (Riyadh) - Operated by Partner regions: USD 0.6/connection/hour.

      • For other regions: USD 0.5/connection/hour.

    Important

    The 3 Gbps tunnel bandwidth (Large) feature is in public beta. To use this feature, contact your account manager to apply.

    This fee is charged hourly per ipsec-vpn connection. Partial hours are billed as full hours.

    Public network traffic fee

    This fee applies only to outbound traffic. Starting in March 2026, billing will gradually transition to CDT.

    TR connection fee

    • The Chinese mainland: USD 0.05/connection/hour.

    • Outside the Chinese mainland: USD 0.06/connection/hour.

    Charged by CEN. For more information, see CEN billing.

    TR traffic processing fee

    USD 0.02/GB.

    Notes:

    • Public network traffic fees do not apply to private ipsec-vpn connections.

    • After you bind an ipsec-vpn connection to a Transit Router, you cannot change the bound resource type or the billing method.

    • A single ipsec-vpn connection supports a maximum tunnel bandwidth of 1 Gbps or 3 Gbps. This bandwidth specification cannot be changed. To increase the bandwidth between your on-premises data center and the cloud, you can establish multiple ipsec-vpn connections.

      The 3 Gbps tunnel bandwidth (Large) feature is in public beta. To use this feature, contact your account manager to apply.

    Unit prices for public network traffic

    For ipsec-vpn connections bound to a Transit Router, billing for public network traffic is gradually transitioning to CDT:

    • After the switch to CDT billing, public network traffic fees are calculated based on CDT Pricing.

    • Before the switch to CDT billing, the following rates apply (Unit: USD/GB):

      Region

      Price (USD/GB)

      The Chinese mainland

      0.125

      China (Hong Kong)

      0.153

      Singapore

      0.117

      Japan (Tokyo)

      0.120

      South Korea (Seoul)

      0.125

      Thailand (Bangkok)

      0.117

      Philippines (Manila)

      0.110

      Malaysia (Kuala Lumpur)

      0.125

      Indonesia (Jakarta)

      0.110

      US (Virginia)

      0.078

      US (Silicon Valley)

      0.078

      Germany (Frankfurt)

      0.070

      UK (London)

      0.070

      Mexico

      0.078

      UAE (Dubai)

      0.12

      SAU (Riyadh - Partner Region)

      0.140

      Important

      The prices in the preceding tables are for reference only. The prices on the purchase page prevail.

    Examples

    An on-premises data center connects to a Transit Router in the Singapore region through one public ipsec-vpn connection to communicate with a VPC. Over a 24-hour period, the inbound traffic is 50 GB and the outbound traffic is 200 GB. The fees for the ipsec-vpn connection during this period are calculated as follows:

    After the switch to CDT billing

    • IPsec-VPN connection instance fee= USD 0.05/connection/hour × 24 hours × 1 connection = USD 1.20

    • Public network traffic fee (outbound only)= USD 0.125/GB × (200 - 200) GB = USD 0.00 (For regions outside the Chinese mainland, CDT provides 200 GB of free outbound traffic per month.)

    • TR connection fee= USD 0.05/connection/hour × 24 hours × 1 connection = USD 1.20

    • TR traffic processing fee (inbound to TR only)= USD 0.02/GB × 50 GB = USD 1.00

    • Total fee = 1.20 + 0.00 + 1.20 + 1.00 = USD 3.40

    Before the switch to CDT billing

    • IPsec-VPN connection instance fee= USD 0.05/connection/hour × 24 hours × 1 connection = USD 1.20

    • Public network traffic fee (outbound only)= USD 0.125/GB × 200 GB = USD 25.00

    • TR connection fee= USD 0.05/connection/hour × 24 hours × 1 connection = USD 1.20

    • TR traffic processing fee (inbound to TR only)= USD 0.02/GB × 50 GB = USD 1.00

    • Total fee = 1.20 + 25.00 + 1.20 + 1.00 = USD 28.40

    View bills

    • Go to the Billing & Cost Management console to view billing details.

    • Internet traffic fees are billed under Cloud Data Transfer (CDT).

    • For bound transit routers, the TR connection fee and TR data processing fee are billed under Cloud Enterprise Network (CEN).

    Documentation

    FAQ

    Mainland China regions

    China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Nanjing) (Local Region) (decommissioning), China (Shenzhen), China (Heyuan), China (Guangzhou), and China (Chengdu).

    Does IPsec-VPN support free trials or free connectivity plans?

    Alibaba Cloud IPsec-VPN does not support free trials or complimentary connectivity. All IPsec-VPN solutions, including dedicated connections and IPsec connectivity, require separate purchase.

    If you need to test or validate connectivity at low cost, consider the following options:

    • Enhanced VPN gateway: Purchase a lower-spec pay-as-you-go instance for testing. Release the instance after testing to stop further charges.

    • Standard VPN gateway: Purchase a short-term subscription instance and submit an unsubscription request to release the resource after testing.

    When transferring OSS data through an ECS instance via a VPN gateway to an on-premises data center, are there additional traffic fees?

    ECS does not incur additional fees for this data transfer scenario. VPN gateway fees are determined by the binding mode:

    • Standard VPN gateway: IPsec-VPN instance fee + data transfer fee (pay-as-you-go)

    • Enhanced VPN gateway: IPsec connection fee + outbound public network traffic fee (pay-as-you-go)

    • Binding to a Transit Router: IPsec connection instance fee + TR connection fee + TR traffic processing fee + outbound public network traffic fee (pay-as-you-go)

    Note

    Public network traffic fees apply only to outbound traffic. Inbound traffic is free.

    If I selected the wrong VPC when creating a VPN gateway, how do I change the bound VPC?

    VPN gateways do not support directly changing the bound VPC after creation. To use a different VPC, you must release the current VPN gateway instance and purchase a new one with the correct VPC selected.

    For the release procedure, see Overdue payments and refunds.