What is an IPv6 gateway?
IPv6 Gateway is an IPv6 traffic gateway of VPC. By default, an IPv6 address that you apply for supports only private IPv6 communication. You can enable IPv6 Internet bandwidth for an IPv6 address in an IPv6 gateway so that the address can communicate over the Internet. You can also configure an Egress-only rule so that the IPv6 address can only initiate access to the Internet.
Basic concepts
Term | Description |
IPv6 address | An IPv6 address is automatically assigned by the system or manually assigned. Example of an IPv6 address: 2001:db8:1:1:1:1:1:1 The system also supports assigning IPv6 prefixes, which are IP address ranges in IPv6 CIDR format. Example of an IPv6 prefix: fd02:XXXX:7:f900:6ce2::/80 |
IPv6 gateway | An IPv6 gateway is a key component that connects the IPv6 network in a VPC to the IPv6 Internet. It provides IPv6 Internet bandwidth management and Egress-only rule management. |
IPv6 Internet bandwidth | The Internet bandwidth of an IPv6 address. It determines whether the IPv6 address can communicate over the Internet. An IPv6 address can communicate with the Internet only after IPv6 Internet bandwidth is enabled for the address. |
Egress-only rule | An Egress-only rule is a rule that an IPv6 gateway uses to manage IPv6 Internet traffic. An IPv6 address for which an Egress-only rule is configured can only initiate access to the IPv6 Internet. |
IPv6 CIDR block for VPC | When you enable IPv6 for a VPC, the system automatically assigns an IPv6 CIDR block with a subnet mask of /56 to the VPC. |
IPv6 CIDR block for vSwitch | The subnet mask of the IPv6 CIDR block for a vSwitch is /64 by default. When you enable IPv6 for a vSwitch, you can customize the last 8 bits of the IPv6 CIDR block. |
Features
An IPv6 gateway provides the following features:
IPv6 private communication
By default, the IPv6 Internet bandwidth of an IPv6 address that you apply for in a VPC is 0 Mbit/s, and the address supports only private communication. Cloud instances in a VPC can use the IPv6 address to access only other IPv6 addresses in the same VPC. The cloud instances cannot use the IPv6 address to access the Internet, and IPv6 clients on the Internet cannot access the cloud instances.
IPv6 public communication
You can purchase IPv6 Internet bandwidth for an IPv6 address that you applied for. Cloud instances in a VPC can then use the IPv6 address to access the Internet, and IPv6 clients on the Internet can access the cloud instances in the VPC.
You can set the IPv6 Internet bandwidth of an IPv6 address to 0 at any time. After you do so, the IPv6 address supports only private communication.
You can configure an Egress-only rule so that an IPv6 address can only initiate access to the Internet, and IPv6 clients on the Internet cannot access the cloud instances in the VPC.
You can delete an Egress-only rule at any time. After you delete the rule, an IPv6 address that has IPv6 Internet bandwidth can not only initiate access to the Internet, but also accept access from IPv6 clients on the Internet.
The communication capability of an IPv6 address depends on the network type, IPv6 Internet bandwidth and Egress-only rule of the address, as described in the following table.
IPv6 network type | Whether IPv6 Internet bandwidth is enabled | Whether an Egress-only rule is configured | IPv6 address communication capability |
Private network | No | No | Private communication |
Public network | Yes | No | Private communication Public communication |
Yes | Private communication Outbound Internet access only |
Scenarios
Scenario 1: Quickly enable IPv6 for your business and build an isolated IPv6 environment in the cloud
When you enable IPv6 for an existing VPC, the VPC supports both the IPv4 and IPv6 protocol stacks. When you assign IPv6 addresses to the ECS instances in the cluster where your business runs, each ECS instance has both an IPv4 address and an IPv6 address. By default, the IPv6 address of an ECS instance has only the permission for private IPv6 communication within the VPC.
An IPv4/IPv6 dual-stack ECS cluster can be connected over the IPv4 private network or the IPv6 network. IPv4 and IPv6 communication are independent of each other.
ECS instances cannot use IPv6 addresses to access the Internet, and IPv6 clients on the Internet cannot access the ECS instances.
Scenario 2: Instances in a VPC communicate with the Internet over IPv6 addresses
After you enable IPv6 Internet bandwidth for an IPv6 address, the address has the permission for public IPv6 communication. IPv6 traffic between instances in a VPC and the IPv6 network passes through the IPv6 gateway, which serves as the ingress and egress of IPv6 Internet traffic in a dual-stack VPC.
The existing IPv4 business traffic of the ECS cluster in the VPC can still use Elastic IP Address, Server Load Balancer and NAT gateways to communicate with the IPv4 Internet.
Scenario 3: Outbound-only IPv6 Internet traffic
Your business needs to initiate access to IPv6 clients only, and you do not want external IPv6 clients to connect to the IPv6 addresses of ECS instances.
Configure an Egress-only rule for the IPv6 address of a specified ECS instance. The ECS instance can then initiate access to the IPv6 network over the IPv6 address, and the IPv6 gateway drops access that external IPv6 clients initiate.
Benefits
IPv6 gateways provide the following benefits:
High availability
IPv6 gateways provide cross-zone high availability to help you build a stable IPv6 Internet gateway service.
High performance
A single IPv6 gateway instance can provide throughput of up to 10 Gbit/s to meet the IPv6 Internet requirements of very large businesses.
Flexible management of Internet communication
You can adjust IPv6 Internet bandwidth and configure Egress-only rules to set the Internet communication capability of an IPv6 address.
Regions that support IPv6 gateways
Area | Regions |
Asia Pacific - China | China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Fuzhou - Local Region), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), China (Zhongwei), China (Nanjing - Local Region), China (Wuhan - Local Region) |
Asia Pacific - Others | Philippines (Manila), Singapore, Japan (Tokyo), South Korea (Seoul), Indonesia (Jakarta), Malaysia (Kuala Lumpur), Malaysia (Johor), Thailand (Bangkok) |
Europe & Americas | US (Virginia), US (Silicon Valley), Germany (Frankfurt), UK (London), Mexico, France (Paris) |
Middle East | UAE (Dubai) |
IPv6 access
After you register an Alibaba Cloud account, you can access and manage IPv6 gateways by using the following methods:
IPv6 gateway console: a web service page with interactive operations. You can log on to the console to create, use or delete VPC instances. For more information, see Create and manage an IPv6 Gateway.
Alibaba Cloud SDK: provides SDK support for multiple programming languages, such as Java, Go, PHP, Python, C# and C++.
OpenAPI Developer Portal: provides services such as fast API search, online calling of API operations, and dynamic generation of SDK sample code.
Alibaba Cloud App: a mobile management tool.
Terraform: an open source tool that allows you to call computing resources on Alibaba Cloud and on other cloud platforms that support Terraform by using configuration files, and to perform version control on the resources.