You can use a transit router to route traffic from multiple Virtual Private Clouds (VPCs) to the internet through a single Internet NAT gateway. This setup centralizes internet egress and removes the need to create a separate NAT gateway for each VPC.
Background
Cloud Enterprise Network (CEN) is a highly available network built on Alibaba Cloud's private global network. CEN uses a transit router (TR) to establish private communication channels between VPCs in different regions, or between VPCs and on-premises data centers.
A transit router instance is a core forwarding component within a region. It forwards traffic between network instances in the same or different regions and supports flexible routing policies. Within a CEN instance, you can create one transit router instance in each region. You can connect network instances to an Enterprise Edition transit router. After the connection is established, the Enterprise Edition transit router stores the routes of the network instances and forwards traffic by looking up entries in its route table.
For more information, see How a transit router works.
Example scenario
A company has two VPCs, VPC-A and VPC-B, in the China (Chengdu) region. In VPC-A, vSwitch-A1 and vSwitch-A2 are created. An Internet NAT gateway is created in vSwitch-A1 and an ECS instance named ECS1 is created in vSwitch-A2. In VPC-B, vSwitch-B1 and vSwitch-B2 are created, and an ECS instance named ECS2 is created in vSwitch-B1. For business purposes, both VPC-A and VPC-B require internet access.
The company can use a transit router and its route table feature to meet this requirement. By creating an Internet NAT gateway in VPC-A and configuring SNAT entries for the gateway, both VPC-A and VPC-B can access the internet through the shared NAT gateway.
Prerequisites
You have created the VPCs and vSwitches as described in the following table. For more information, see Create and manage a VPC.
VPC
Region
vSwitch
Zone and CIDR block
VPC-A
China (Chengdu)
vSwitch-A1
Chengdu zone A, 192.168.10.0/24
vSwitch-A2
Chengdu zone B, 192.168.20.0/24
VPC-B
vSwitch-B1
Chengdu zone A, 172.16.10.0/24
vSwitch-B2
Chengdu zone B, 172.16.20.0/24
You have created an ECS instance named ECS1 in vSwitch-A2 and an ECS instance named ECS2 in vSwitch-B1. For more information, see Create an instance on the Custom Launch tab.
You have created a CEN instance. For more information, see Create a CEN instance.
You have created an Enterprise Edition transit router instance in the region where your VPCs are located. For more information, see Create a transit router instance.
Procedure
Step 1: Create an Internet NAT gateway
Log on to the NAT Gateway console.
On the Internet NAT Gateway page, click Create Internet NAT Gateway.
On the NAT Gateway page, configure the following parameters and click Buy Now.
Parameter
Description
Region
Select the region where you want to create the Internet NAT gateway.
Network And Zone
Select the VPC and vSwitch to which the NAT gateway belongs. After the NAT gateway is created, you cannot change the VPC or vSwitch.
Network Type
In this example, Internet NAT Gateway is selected.
Internet NAT Gateway: provides Network Address Translation capabilities and can be associated with EIPs to allow ECS instances to access the Internet, enabling communication between private and public networks.
VPC NAT Gateway: also provides Network Address Translation capabilities but cannot be associated with EIPs. It can only provide address translation within private networks for ECS instances, suitable for scenarios such as hiding internal addresses and avoiding address conflicts.
Elastic IP Address
In this example, Purchase And Associate EIP is selected.
Select Existing
EIP Instance: Select an EIP that is Not Associated With An Instance.
Purchase And Associate EIP: By default, a pay-by-traffic BGP (Multi-ISP) EIP is created. You can select a Bandwidth Peak based on your business requirements.
NoteIf you want to associate an EIP with a different line type or billing method, first apply for an EIP, and then Select An Existing EIP to associate.
Each EIP that you associate with a NAT gateway occupies a private IP address of the vSwitch to which the NAT gateway belongs. Make sure that the vSwitch has sufficient available private IP addresses. Otherwise, you cannot associate new EIPs with the NAT gateway.
Configure Later: The created NAT gateway will not have Internet access capabilities. You need to manually associate an EIP with the NAT gateway.
You can find the Internet NAT gateway on the Internet NAT Gateway page.
Step 2: Create VPC connections and configure routes
Create connections for VPC-A and VPC-B to the transit router in the China (Chengdu) region, and then configure routes for the transit router.
Log on to the CEN console, find the CEN instance that you want to manage, and then click its ID.
On the tab, find the transit router in the destination region. In the Actions column, click Create Connection.
Create VPC connections for VPC-A and VPC-B.
NoteFor information about the regions and zones that support Enterprise Edition transit routers, see Transit router editions.
On the Transit Router Route Table tab, click Create Route Entry.
Add a route entry for 0.0.0.0/0 and point it to the VPC-A connection to forward IPv4 traffic to VPC-A.
Step 3: Configure the VPC route table
Add a 0.0.0.0/0 route entry to the route table and set the next hop to the transit router to forward IPv4 traffic to it.
Log on to the VPC console.
In the left-side navigation pane, click Route Tables.
On the Route Tables page, find the system route table of VPC-B and click its ID.
On the route table details page, click the tab and then click Add Route Entry.
In the Add Route Entry panel, configure the following parameters and click OK.
Parameter
Description
Name
Enter a name for the route entry.
Destination CIDR Block
Select IPv4 CIDR Block and then enter 0.0.0.0/0.
Next Hop Type
Select the instance type for the next hop.
In this example, select Transit Router.
Forwarding Router
Select the VPC-B connection.
You can view the created route entry that points to the VPC-B connection on the Custom Route tab.
Step 4: Create an SNAT entry
Configure an SNAT entry on the NAT gateway to allow specified resources to access the internet through the associated EIP.
- On the Internet NAT Gateway page, find the NAT gateway that you want to manage and click Configure SNAT in the Actions column.
On the SNAT Management tab, click Create SNAT Entry.
On the Create SNAT Entry page, configure the following parameters and click OK.
Parameter
Description
SNAT Entry
In this example, VPC is selected. You can select an SNAT entry type based on your business requirements.
VPC: Suitable for scenarios where all ECS instances in the VPC, along with ECS instances in other VPCs or data centers that are connected through CEN or dedicated lines and have 0.0.0.0/0 routes pointing to this VPC, need to access the Internet through the same EIP.
VSwitch: Suitable for scenarios where fine-grained control over Internet access is required, allowing only specified vSwitches to have Internet access capabilities.
ECS/ENI: Suitable for scenarios where fine-grained control over Internet access is required, allowing only specified ECS instances or elastic network interfaces (ENIs) to have Internet access capabilities.
Custom CIDR Block: Suitable for scenarios where you need to flexibly specify any IP CIDR block to configure Internet access capabilities through NAT gateway. This can cover various network environments within a VPC, across VPCs, or across on-premises data centers, meeting the requirements of complex or customized network structures.
NoteIf you select multiple vSwitches or ECS instances/ENIs, multiple SNAT entries will be created using the same public IP address.
Select EIP
Select the EIP that is used to access the Internet.
Verify the configuration
Log on to the ECS1 and ECS2 instances by using the Workbench console.
Run the command
ping 223.5.5.5.A successful ping response shows that the ECS1 and ECS2 instances can access the internet.
