All Products
Search
Document Center

VPN Gateway:SSL-VPN billing

Last Updated:Feb 28, 2026

When you enable SSL-VPN on a VPN gateway, you are charged on a pay-as-you-go basis for three components: the connection fee, the SSL-VPN specification fee, and the outbound data transfer fee. Each billing cycle is one hour, rounded up.

Fee components

The billable items depend on which features are enabled on the VPN gateway.

Features enabledBillable itemsBilling methodBilling cycle
SSL-VPN onlySSL-VPN instance fee, SSL-VPN specification fee, Data transfer feePay-as-you-goHourly (rounded up)
SSL-VPN and IPsec-VPNIPsec-VPN instance fee, SSL-VPN connection fee, SSL-VPN specification fee, Data transfer feePay-as-you-goHourly (rounded up)
Important
  • The prices listed in the following tables are for reference only. The prices on the buy page prevail.

  • The maximum bandwidth for VPN gateways in the China (Nanjing - Local Region) region is 500 Mbit/s.

  • In the following tables, "Not supported" means the bandwidth specification is not available for VPN gateways in that region.

Connection fee

For the same bandwidth specification in the same region, IPsec-VPN and SSL-VPN connection unit prices are identical.

Regions in the Chinese mainland

China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Nanjing - Local Region), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu)

Unit: USD per hour.

Region10 Mbit/s100 Mbit/s200 Mbit/s500 Mbit/s1,000 Mbit/s
The Chinese mainland0.0590.2090.2090.7670.767
Hong Kong (China)0.0870.2620.2621.0251.025
Singapore0.0870.2620.2621.0251.025
Japan (Tokyo)0.0910.2750.2750.7670.767
South Korea (Seoul)0.0910.2750.2750.7670.767
Thailand (Bangkok)0.0870.2620.2621.0251.025
Philippines (Manila)0.0870.2620.2621.0251.025
Malaysia (Kuala Lumpur)0.0800.2400.2400.8780.878
Indonesia (Jakarta)0.0860.2620.2620.7340.734
US (Virginia)0.0660.2950.2950.8260.826
US (Silicon Valley)0.0820.3920.3921.0951.095
Germany (Frankfurt)0.0770.3590.3591.0031.003
UK (London)0.0770.3590.3591.0031.003
Mexico0.0660.2950.2950.8260.826
UAE (Dubai)0.0900.4200.4201.231Not supported
SAU (Riyadh - Partner Region)0.1040.3140.3141.230Not supported
Important

The SAU (Riyadh - Partner Region) region is operated by a partner.

Data transfer fee

Outbound data transfer from Alibaba Cloud to an on-premises data center over a VPN connection is billed. Inbound data transfer is free.

Unit: USD per GB.

RegionPrice
The Chinese mainland0.125
Hong Kong (China)0.153
Singapore0.117
Japan (Tokyo)0.120
South Korea (Seoul)0.125
Thailand (Bangkok)0.117
Philippines (Manila)0.110
Malaysia (Kuala Lumpur)0.125
Indonesia (Jakarta)0.110
US (Virginia)0.078
US (Silicon Valley)0.078
Germany (Frankfurt)0.070
UK (London)0.070
Mexico0.078
UAE (Dubai)0.447
SAU (Riyadh - Partner Region)0.140
Important

The SAU (Riyadh - Partner Region) region is operated by a partner.

SSL-VPN specification fee

The SSL-VPN specification determines the maximum number of concurrent SSL-VPN connections. Select a specification based on how many clients connect at the same time.

Unit: USD per hour.

All regions except SAU (Riyadh - Partner Region) share the same prices:

Maximum concurrent connections51020501005001,000
All regions (except SAU)0.0480.0740.1170.2260.3281.0901.547
SAU (Riyadh - Partner Region)0.0580.0890.140.2710.3941.3081.856
Important

The SAU (Riyadh - Partner Region) region is operated by a partner.

Billing example

An enterprise in the Chinese mainland connects a client to a VPC over SSL-VPN. The VPN gateway has only SSL-VPN enabled, with a bandwidth of 10 Mbit/s and a maximum of 5 concurrent SSL-VPN connections. Over a 24-hour period (00:00:00 June 1, 2023 to 00:00:00 June 2, 2023), 10 GB of data is sent from the VPN gateway to the client.

Fee componentCalculationAmount (USD)
SSL-VPN connection feeUSD 0.059/hour x 24 hours1.416
SSL-VPN specification feeUSD 0.048/hour x 24 hours1.152
Data transfer feeUSD 0.125/GB x 10 GB1.25
Total3.818

Upgrade a VPN gateway

AttributeDescription
What you can upgradeBandwidth of the VPN gateway.
Upgrade limitsIf the bandwidth of your VPN gateway is 200 Mbit/s or less, you cannot upgrade directly to 500 Mbit/s or 1,000 Mbit/s. If the bandwidth is 500 Mbit/s, you can upgrade only to 1,000 Mbit/s.
Impact on servicesServices are not affected during the upgrade.
When it takes effectImmediately after you submit the order. Allow a few minutes for network latency.
Impact on billingThe system bills based on the new configuration after the order is submitted.
Note

To enable IPsec-VPN, enable SSL-VPN, or increase the maximum number of concurrent SSL-VPN connections, see the following topics:

Procedure

  1. Log on to the VPN Gateway console.

  2. In the top menu bar, select the region of the VPN gateway.

  3. On the VPN Gateways page, find the VPN gateway that you want to upgrade and click Upgrade in the Bandwidth column.

  4. On the VPN Gateway | Upgrade/Downgrade page, modify the maximum bandwidth of the VPN gateway.

  5. In the Service Agreement section, read and select the service agreement, and then click Buy Now and complete the payment.

Downgrade a VPN gateway

AttributeDescription
What you can downgradeBandwidth of the VPN gateway. You can also disable IPsec-VPN or SSL-VPN, or decrease the maximum number of concurrent SSL-VPN connections.
Downgrade limitsSee the constraints listed below.
When it takes effectImmediately after you submit the order. Allow a few minutes for network latency.
Impact on billingThe system bills based on the new configuration after the order is submitted.

Downgrade constraints:

  • To disable IPsec-VPN, delete all IPsec-VPN connections created for the VPN gateway first. For more information, see the Delete an IPsec-VPN connection section of the "Create and manage IPsec-VPN connections in dual-tunnel mode" topic.

  • To disable SSL-VPN, delete all SSL servers and IPsec servers associated with the VPN gateway first. For more information, see the Delete an SSL server section of the "Create and manage an SSL server" topic and the Delete an IPsec server section of the "Create and manage IPsec servers" topic.

  • If the bandwidth of your VPN gateway is 1,000 Mbit/s, you can downgrade only to 500 Mbit/s. If the bandwidth is 500 Mbit/s, you cannot downgrade further.

    Note

    If you use a VPN gateway that supports dual-tunnel IPsec-VPN connections, contact your account manager to remove bandwidth downgrade limits.

  • If traffic exceeds the new maximum bandwidth during the downgrade, connections may be interrupted. Enable automatic reconnection for your services.

  • If you decrease the maximum number of concurrent SSL-VPN connections and the number of connected clients exceeds the new limit, some connections may be interrupted. Enable automatic reconnection for your services.

Procedure

  1. Log on to the VPN Gateway console.

  2. In the top menu bar, select the region of the VPN gateway.

  3. On the VPN Gateways page, find the VPN gateway that you want to downgrade and click Downgrade in the Bandwidth column.

  4. On the VPN Gateway | Downgrade page, modify the configuration of the VPN gateway. You can downgrade the maximum bandwidth, disable IPsec-VPN or SSL-VPN, or downgrade the SSL-VPN specification.

  5. In the Service Agreement section, read and select the service agreement, and then click Buy Now and complete the payment.

View bills

Log on to the Expenses and Costs console. In the left-side navigation pane, choose Bills > Bill Details. For more information, see Bill Management.

Overdue payment handling

If the available balance of your Alibaba Cloud account, including vouchers and coupons, is less than the amount due, an overdue payment occurs.

TimelineWhat happens
Overdue payment occursThe VPN gateway continues to run for 15 days. Add funds to your account as soon as possible.
15 days after overdueThe VPN gateway is suspended. If you add funds after suspension, the system automatically pays the outstanding amount and the VPN gateway resumes immediately.
15 days after suspension (30 days total)The VPN gateway is automatically released. All configurations and data are deleted and cannot be restored.
Important

The system sends a text message and email notification one day before releasing the VPN gateway.

FAQ

Is a partial hour billed as a full hour?

Yes. Each billing cycle is one hour. Usage of less than one hour is rounded up to one hour.

Is inbound data transfer charged?

No. Only outbound data transfer from Alibaba Cloud to your on-premises data center is billed. Inbound data transfer is free.

What happens if I change my VPN gateway configuration mid-billing cycle?

The new configuration takes effect immediately. The system bills based on the new configuration from the time you submit the order.