CreateSecurityProxy-阿里云帮助中心

Creates a NAT firewall.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-cloudfirewall:CreateSecurityProxy

get

*全部资源

*

None

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The response language. Valid values: zh (default): Chinese. en: English.	zh
ProxyName	string	Yes	The name of the NAT firewall. The name can contain uppercase and lowercase letters, Chinese characters, digits, and underscores (_). The name must be 4 to 50 characters in length and cannot start with an underscore.	nat-firewall
RegionNo	string	Yes	The region ID of the VPC. Note For more information about the regions supported by Cloud Firewall, see Supported regions.	cn-hangzhou
VpcId	string	Yes	The instance ID of the VPC.	vpc-uf6b5lyul0x******
NatGatewayId	string	Yes	The ID of the NAT gateway.	ngw-bp1okz6k7******
VswitchAuto	string	No	Whether to use automatic vSwitch mode. Valid values: true: automatic mode false: manual mode.	true
VswitchId	string	No	The vSwitch ID. Required when the vSwitch is in manual mode.	vsw-bp1sqg9w******
NatRouteEntryList	array<object>	Yes	The list of routes to be switched for the NAT gateway.
	object	No	The list of destination addresses for security protection.
NextHopId	string	Yes	The next hop ID of the original NAT gateway.	ngw-bp1okz6******
DestinationCidr	string	Yes	The destination CIDR block of the default route.	0.0.0.0/0
NextHopType	string	Yes	The network type of the next hop. Valid values: NatGateway.	NatGateway
RouteTableId	string	Yes	The route table that contains the default route entry of the NAT gateway.	vtb-2ze1******
FirewallSwitch	string	No	The security protection switch. Valid values: open: enabled. close: disabled.	close
StrictMode	integer	No	Whether to enable strict mode. Valid values: 1: enables strict mode. 0: disables strict mode.	0
VswitchCidr	string	No	The CIDR block of the vSwitch. Required when the vSwitch is in automatic mode.	0.0.0.0/0
FwVswitchZoneId	string	No	The zone of the firewall vSwitch.	cn-beijing-b

Response elements

Element	Type	Description	Example
	object
ProxyId	string	The NAT firewall ID.	proxy-nat97a******
RequestId	string	The request ID.	15FCCC52-1E23-57AE-B5EF-3E00A3******

Examples

Success response

JSON format

{
  "ProxyId": "proxy-nat97a******",
  "RequestId": "15FCCC52-1E23-57AE-B5EF-3E00A3******"
}

Error codes

HTTP status code	Error code	Error message	Description
400	ErrorAliUid	Aliuid invalid.	aliuid无效
400	ErrorParamProxyNameError	proxy name invalid.	NAT防火墙名称无效。
400	ErrorRegionNoError	Region is error, please reselect	地域选择错误, 请重新输入
400	ErrorVpcIdError	Vpc ID invalid.	VPC选择错误，请重新选择。
400	ErrorDnatNotSupport	Secure proxy does not support DNAT entries.	NAT防火墙暂不支持DNAT。
400	ErrorProxySnatIpEmpty	SNAT entry is empty.	SNAT条目为空。
400	ErrorSnatIpQuotaExceed	The number of SNAT IP exceeds the specification.	NAT网关EIP个数超过单个NAT防火墙支持的规格。
400	ErrorDBSelectError	A database select error occurred.	内部错误：数据库查询错误
400	ErrorDefaultRouteConflicts	Default route conflicts.	所选交换机绑定的路由表中已存在默认路由。
400	ErrorUserCredentials	User credentials failed.	未授权，不可访问，请先授权防火墙权限。
400	ErrorVpcOpenApi	vpc open api failed	调用 VPC API 失败
400	ErrorVswitchNotFound	vswitch not found	vswitch 不存在, 请重新选择
400	ErrorProxyRouteEntryConflicts	Proxy custom route table Nat Gateway and Attachment route entry conflict.	NAT网关的自定义路由表存在下一跳为NatGateway和Attachment的路由条目。
400	ErrorVswitchNoAvailableCidr	No available CIDR to create a vswitch.	VPC内没有空余网段可创建交换机。
400	ErrorCidrFormat	Network segment CIDR format error, please select again	网段CIDR格式错误, 请重新选择
400	ErrorInternal	internal error	内部错误
400	ErrorVswitchCidrNotInVpc	Vswitch CIDR address not in vpc.	交换机网段地址不属于当前VPC。
400	ErrorVswitchRouteConflict	vswitch route conflict.	输入的交换机网段和现有的交换机网段存在冲突。
400	ErrorVswitchCidrIpNumNotEnough	No enough private proxy IP in vswitch cidr.	防火墙交换机没有足够的私网IP。
400	ErrorRouteEntryNotFound	route entry not found.	路由条目不存在。
400	ErrorUserNotFound	User not found	用户不存在.
400	ErrorProxyVpcNotSupportAdvFeature	This vpc advanced feature is not supported.	该VPC含有不支持VPC高级功能的ECS实例。
400	ErrorDBInsertError	A database insert error occurred.	内部错误：数据库插入错误
400	ErrorProxyNumQuotaTop	Proxy num reaches maximum.	配额不足。
400	ErrorProxyClusterNotAvailable	Can not find available cluster for nat firewall.	无法为nat 防火墙分配集群。
400	ErrorDBTxError	A database transaction error occurred.	内部错误：数据库事务错误
400	ErrorRecordLog	record operation log error.	更新操作日志错误。
400	ErrorBandwidthPenalty	Cloud Firewall bandwidth is being overused.	云防火墙带宽超量使用处置中。
400	ErrorGeneralInstanceSpecFull	Cloud Firewall instance specifications are full.	云防火墙实例规格已满。
400	ErrorNatVpnRouteEntryQuotaLimit	The number of VPN routes has reached the quota.	VPN路由到达规格限制
400	ErrorVpcRouteTableQuotaLimit	The number of VPC routing tables has reached the specification limit.	VPC路由表数量到达规格上限
400	ErrorNatCustomRouteEntryDifferent	The custom route entries in the routing tables are inconsistent.	各路由表的自定义路由条目不一致
400	ErrorSnatEntryQuotaExceed	SNAT entry quota exceeded.	SNAT条目个数到达规格限制

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.