DSW instances access the internet through a shared NAT gateway by default. To connect to DSW remotely, improve internet access performance, or expose DSW services to the internet, configure the network options described in this topic.
Connect to DSW remotely
To develop in DSW from VS Code or a terminal on your local machine, choose one of the following methods:
Method A: Direct SSH (recommended) |
Method B: ProxyClient |
|
|
Characteristics |
Requires a VPC, NAT gateway, and other network components. Provides faster, more stable connections. |
No additional network components required. Connection speed and stability may be lower. |
|
Supported instances |
All instance types except those with specifications starting with |
All instance types. |
|
Authentication |
SSH public-key or private-key authentication. |
|
|
Access path |
|
Over the internet. |
|
Configuration |
||
|
How it works |
PAI automatically creates a Destination Network Address Translation (DNAT) rule on the NAT gateway to forward SSH requests from the internet to the DSW instance. |
All traffic is relayed through PAI proxy servers. |
|
Billing |
The NAT gateway and EIP incur charges even after the DSW instance is stopped. Delete them when they are no longer needed. |
No additional charges. |
DSW internet access
Speed up internet downloads
Scenario: The default shared NAT gateway does not provide enough bandwidth for downloading large datasets or models.
Configuration: Improve internet access with a private gateway.
How it works: Outbound traffic from DSW routes through a dedicated NAT gateway and EIP, providing higher bandwidth.
Billing: The NAT gateway and EIP incur charges even after the DSW instance is stopped. Delete them when they're no longer needed.
Accelerate access to overseas resources
Scenario: DSW needs to pull models from Hugging Face or images from Docker Hub.
Configuration: Access overseas models and container images.
How it works: When DSW accesses domains outside mainland China, requests are routed through the Global Accelerator (GA), bypassing congested international links.
Billing: GA is billed separately.
Block internet access from DSW
Scenario: Security or compliance policies require DSW instances to access only resources within the VPC, with no internet access.
Configuration: Create a DSW instance or modify an existing DSW instance. Configure a VPC, vSwitch, and security group. Select a dedicated NAT gateway. Do not create an SNAT entry.
How it works: Without a NAT gateway or SNAT entry, the DSW instance has no outbound route to the internet.
Billing: No additional charges.
Expose DSW services to the internet
Scenario: A web service (such as a model API or WebUI) is running in DSW and needs to be accessible from the internet for testing or sharing.
Configuration: Access services in an instance over the public network.
How it works: Internet requests reach the NAT gateway through the EIP. The NAT gateway forwards them to the private IP address and port of the DSW instance. Ensure the security group allows this inbound traffic.
Billing: The NAT gateway and EIP incur charges even after the DSW instance is stopped. Delete them after testing is complete.
DSW network architecture
The following diagram shows the DSW network architecture:
By default, DSW instances reside in a shared VPC and access the internet through a shared NAT gateway at no charge. DSW instances aren't assigned public IP addresses, so they can't be accessed directly from the internet.
The following components make up the DSW network:
Virtual Private Cloud (VPC): An isolated private network in the cloud for your resources.
vSwitch: A subnet within a VPC. Your DSW instances and other cloud resources, such as databases, connect to a vSwitch.
Security group: A virtual firewall for the DSW instance. It controls all inbound and outbound network traffic. Misconfigured security groups are the most common cause of network connectivity issues.
Shared NAT gateway: The default free egress for DSW. Bandwidth is shared with other users, so speed and stability are not guaranteed.
Dedicated NAT gateway: A dedicated internet egress that provides fast, stable internet access. Billed separately.
Elastic IP address (EIP): A static public IP address, typically bound to a NAT gateway. Billed separately.
Source Network Address Translation (SNAT): Enables DSW instances in a private network to initiate outbound internet traffic.