IPv4 gateway

Console

1. Go to the VPC console - IPv4 Gateway page. Select the region where your VPC is deployed, then click Create IPv4 Gateway.

2. Create IPv4 gateway: Select the VPC for which you want to centralize Internet access control.

3. Activate IPv4 gateway: Select the route tables associated with public vSwitches. The system automatically adds a 0.0.0.0/0 route pointing to the IPv4 gateway, ensuring resources in public vSwitches can access the Internet after associating a public IP address. If the route table already contains a 0.0.0.0/0 route, click Activate Later, update the next hop of that route to the IPv4 gateway, then activate. After activation, VPC Internet access is controlled by the IPv4 gateway.

   • If an ECS instance uses an Internet NAT gateway for Internet access, deploy the ECS instance and the NAT gateway in different vSwitches. Add a 0.0.0.0/0 route pointing to the IPv4 gateway in the route table associated with the NAT gateway vSwitch. Add a route pointing to the NAT gateway in the public vSwitch in the route table associated with the ECS instance vSwitch.

   • If an ECS instance uses a static public IP address or a directly associated EIP, add a 0.0.0.0/0 route pointing to the IPv4 gateway.

API

• Call CreateIpv4Gateway to create an IPv4 gateway.

• Call EnableVpcIpv4Gateway to activate the IPv4 gateway. Set RouteTableList to the route table associated with the public vSwitch. If omitted, call CreateRouteEntry to manually add a 0.0.0.0/0 route pointing to the IPv4 gateway.

Terraform

Unlike the console, activating an IPv4 gateway via Terraform does not automatically add a 0.0.0.0/0 route pointing to the IPv4 gateway. You must configure the route manually.

Resource: alicloud_vpc, alicloud_vswitch, alicloud_vpc_ipv4_gateway, alicloud_route_table, alicloud_route_table_attachment, alicloud_vpc_route_entry, alicloud_instance, alicloud_security_group, alicloud_security_group_rule, alicloud_eip_address, alicloud_eip_association, alicloud_nat_gateway, alicloud_snat_entry

Data Sources: alicloud_zones

# Specify the region for the IPv4 gateway
provider "alicloud" {
  region = "cn-hangzhou"
}

# Automatically obtain zones that support vSwitch creation
data "alicloud_zones" "available_zones" {
  available_resource_creation = "VSwitch" # Query zones available for VPC resources
}

# Create a VPC 
resource "alicloud_vpc" "example_vpc" {
  vpc_name   = "example_vpc_name"
  cidr_block = "10.0.0.0/16" # Specify the CIDR block 
}

# Define vSwitch configurations
locals {
  vswitches = {
    vsw1 = {
      name       = "example_vsw1_name"
      cidr_block = "10.0.0.0/24"
      zone_index = 0
    }
    vsw2 = {
      name       = "example_vsw2_name"
      cidr_block = "10.0.1.0/24"
      zone_index = 1
    }
    vsw3 = {
      name       = "example_vsw3_name"
      cidr_block = "10.0.2.0/24"
      zone_index = 0
    }
    vsw4 = {
      name       = "example_vsw4_name"
      cidr_block = "10.0.3.0/24"
      zone_index = 0
    }
  }

  # Define route table configurations
  route_tables = {
    rt1 = {
      name        = "example_rt1_name"
      vswitch_key = "vsw1"
    }
    rt2 = {
      name        = "example_rt2_name"
      vswitch_key = "vsw2"
    }
    rt3 = {
      name        = "example_rt3_name"
      vswitch_key = "vsw3"
    }
    rt4 = {
      name        = "example_rt4_name"
      vswitch_key = "vsw4"
    }
  }

  # Define instance configurations
  instances = {
    instance1 = {
      name        = "example_instance1_name"
      vswitch_key = "vsw1"
    }
    instance2 = {
      name        = "example_instance2_name"
      vswitch_key = "vsw3"
    }
    instance3 = {
      name        = "example_instance3_name"
      vswitch_key = "vsw4"
    }
  }

  # Define EIP configurations
  eips = {
    eip1 = {
      name = "example_eip1_name"
    }
    eip2 = {
      name = "example_eip2_name"
    }
  }

  # Define SNAT entry configurations
  snat_entries = {
    snat1 = {
      instance_key = "instance2"
    }
    snat2 = {
      instance_key = "instance3"
    }
  }
}

# Create multiple vSwitches
resource "alicloud_vswitch" "example_vsw" {
  for_each = local.vswitches

  vswitch_name = each.value.name
  cidr_block   = each.value.cidr_block
  vpc_id       = alicloud_vpc.example_vpc.id
  zone_id      = data.alicloud_zones.available_zones.zones[each.value.zone_index].id
}

# Create multiple custom route tables
resource "alicloud_route_table" "example_route_table" {
  for_each = local.route_tables

  route_table_name = each.value.name
  vpc_id           = alicloud_vpc.example_vpc.id
}

# Associate route tables with vSwitches
resource "alicloud_route_table_attachment" "example_route_table_attachment" {
  for_each = local.route_tables

  vswitch_id     = alicloud_vswitch.example_vsw[each.value.vswitch_key].id
  route_table_id = alicloud_route_table.example_route_table[each.key].id
}

# Specify instance type
variable "instance_type" {
  default = "ecs.e-c1m1.large"
}

# Specify image ID
variable "image_id" {
  default = "aliyun_3_x64_20G_alibase_20221102.vhd"
}

# Create a security group
resource "alicloud_security_group" "example_security_group" {
  security_group_name = "example_security_group_name"
  vpc_id              = alicloud_vpc.example_vpc.id
}

# Create a security group rule. Modify the protocol and port as needed.
resource "alicloud_security_group_rule" "allow_internet" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group.id
  cidr_ip           = "0.0.0.0/0"
}

# Create multiple ECS instances
resource "alicloud_instance" "example_instance" {
  for_each = local.instances

  instance_name        = each.value.name
  vswitch_id           = alicloud_vswitch.example_vsw[each.value.vswitch_key].id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group.id]
  instance_charge_type = "PostPaid"           # Pay-as-you-go billing
  spot_strategy        = "SpotWithPriceLimit" # Spot instance with price cap
}

# Create multiple EIPs
resource "alicloud_eip_address" "example_eip" {
  for_each = local.eips

  address_name = each.value.name
  isp          = "BGP"
  netmode      = "public"
  bandwidth    = "1"
  payment_type = "PayAsYouGo"
}

# Associate the ECS instance with an EIP
resource "alicloud_eip_association" "example_eip_ecs_association" {
  allocation_id = alicloud_eip_address.example_eip["eip1"].id
  instance_type = "EcsInstance"
  instance_id   = alicloud_instance.example_instance["instance1"].id
}

# Create an Internet NAT gateway
resource "alicloud_nat_gateway" "example_natgw" {
  nat_gateway_name = "example_natgw_name"
  vpc_id           = alicloud_vpc.example_vpc.id
  vswitch_id       = alicloud_vswitch.example_vsw["vsw2"].id
  nat_type         = "Enhanced"
  eip_bind_mode    = "NAT" # EIP binding mode must be NAT
  payment_type     = "PayAsYouGo"
}

# Associate the EIP with the Internet NAT gateway
resource "alicloud_eip_association" "example_eip_natgw_association" {
  allocation_id = alicloud_eip_address.example_eip["eip2"].id
  instance_type = "NAT"
  instance_id   = alicloud_nat_gateway.example_natgw.id
}

# Add a route pointing to the NAT gateway
resource "alicloud_route_entry" "example_rt3_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt3"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "NatGateway"
  nexthop_id            = alicloud_nat_gateway.example_natgw.id
}

# Add a route pointing to the NAT gateway
resource "alicloud_route_entry" "example_rt4_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt4"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "NatGateway"
  nexthop_id            = alicloud_nat_gateway.example_natgw.id
}

# Create SNAT entries
resource "alicloud_snat_entry" "example_snat_entry" {
  for_each = local.snat_entries

  snat_table_id = alicloud_nat_gateway.example_natgw.snat_table_ids
  source_cidr   = alicloud_instance.example_instance[each.value.instance_key].primary_ip_address
  snat_ip       = alicloud_eip_address.example_eip["eip2"].ip_address
}

# Create an IPv4 gateway
resource "alicloud_vpc_ipv4_gateway" "example_ipv4gw" {
  ipv4_gateway_name = "example_ipv4gw_name"
  vpc_id            = alicloud_vpc.example_vpc.id
  enabled           = true
}

# Add a route pointing to the IPv4 gateway
resource "alicloud_route_entry" "example_rt1_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt1"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

# Add a route pointing to the IPv4 gateway
resource "alicloud_route_entry" "example_rt2_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt2"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

Console

1. Go to the VPC console - IPv4 Gateway page. Select the region where your VPC is deployed, then click Create IPv4 Gateway.

2. Create IPv4 gateway: Select the VPC that needs to access the non-standard private CIDR block.

3. Activate IPv4 gateway: Select the route table associated with the vSwitch that needs to access the non-standard private CIDR block. The system automatically adds a 0.0.0.0/0 route pointing to the IPv4 gateway, enabling resources in the vSwitch to reach the non-standard CIDR block via more specific routes.

   • Make sure the route table does not already contain a 0.0.0.0/0 route. If it does, click Activate Later, delete that route, and then activate.

   • After activation, the IPv4 gateway centrally controls Internet access and all traffic is forwarded based on route tables.

API

• Call CreateIpv4Gateway to create an IPv4 gateway.

• Call EnableVpcIpv4Gateway to activate it. Set RouteTableList to the route table associated with the public vSwitch. If omitted, call CreateRouteEntry to manually add a 0.0.0.0/0 route pointing to the IPv4 gateway.

Terraform

Unlike the console, activating an IPv4 gateway via Terraform does not automatically add a 0.0.0.0/0 route pointing to the IPv4 gateway. You must configure the route manually.

Resource: alicloud_vpc, alicloud_vswitch, alicloud_vpc_ipv4_gateway, alicloud_route_table, alicloud_route_table_attachment, alicloud_vpc_route_entry, alicloud_instance, alicloud_security_group, alicloud_security_group_rule, alicloud_eip_address, alicloud_eip_association, alicloud_vpc_peer_connection

Data Sources: alicloud_zones

In this example, the VPCs in the peering connection belong to the same account. For a cross-account peering connection, also create an alicloud_vpc_peer_connection_accepter so the peer account accepts the connection request.

# Specify the region for the IPv4 gateway
provider "alicloud" {
  region = "cn-hangzhou"
}

# Automatically obtain zones that support vSwitch creation
data "alicloud_zones" "available_zones" {
  available_resource_creation = "VSwitch" # Query zones available for VPC resources
}

# Specify instance type
variable "instance_type" {
  default = "ecs.e-c1m1.large"
}

# Specify image ID
variable "image_id" {
  default = "aliyun_3_x64_20G_alibase_20221102.vhd"
}

# Create a VPC
resource "alicloud_vpc" "example_vpc1" {
  vpc_name   = "example_vpc1_name"
  cidr_block = "10.0.0.0/16" # Specify the CIDR block 
}

# Create a VPC
resource "alicloud_vpc" "example_vpc2" {
  vpc_name   = "example_vpc2_name"
  cidr_block = "30.0.0.0/16" # Specify the CIDR block 
}

# Create a vSwitch
resource "alicloud_vswitch" "example_vsw1" {
  vswitch_name = "example_vsw1_name"
  cidr_block   = "10.0.1.0/24"
  vpc_id       = alicloud_vpc.example_vpc1.id
  zone_id      = data.alicloud_zones.available_zones.zones.0.id
}

# Create a vSwitch
resource "alicloud_vswitch" "example_vsw2" {
  vswitch_name = "example_vsw2_name"
  cidr_block   = "30.0.1.0/24"
  vpc_id       = alicloud_vpc.example_vpc2.id
  zone_id      = data.alicloud_zones.available_zones.zones.1.id
}

# Create a security group
resource "alicloud_security_group" "example_security_group1" {
  security_group_name = "example_security_group1_name"
  vpc_id              = alicloud_vpc.example_vpc1.id
}

# Create a security group rule. Modify the protocol and port as needed.
resource "alicloud_security_group_rule" "allow_internet1" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group1.id
  cidr_ip           = "0.0.0.0/0"
}

# Create a security group
resource "alicloud_security_group" "example_security_group2" {
  security_group_name = "example_security_group2_name"
  vpc_id              = alicloud_vpc.example_vpc2.id
}

# Create a security group rule. Modify the protocol and port as needed.
resource "alicloud_security_group_rule" "allow_internet2" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group2.id
  cidr_ip           = "0.0.0.0/0"
}

# Create an ECS instance
resource "alicloud_instance" "example_instance1" {
  instance_name        = "example_instance1_name"
  vswitch_id           = alicloud_vswitch.example_vsw1.id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group1.id]
  instance_charge_type = "PostPaid"
  spot_strategy        = "SpotWithPriceLimit"
}

# Create an EIP
resource "alicloud_eip_address" "example_eip" {
  address_name = "example_eip_name"
  isp          = "BGP"
  netmode      = "public"
  bandwidth    = "1"
  payment_type = "PayAsYouGo"
}

# Associate the ECS instance with an EIP
resource "alicloud_eip_association" "example_eip_ecs_association" {
  allocation_id = alicloud_eip_address.example_eip.id
  instance_type = "EcsInstance"
  instance_id   = alicloud_instance.example_instance1.id
}

# Create an ECS instance
resource "alicloud_instance" "example_instance2" {
  instance_name        = "example_instance2_name"
  vswitch_id           = alicloud_vswitch.example_vsw2.id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group2.id]
  instance_charge_type = "PostPaid"
  spot_strategy        = "SpotWithPriceLimit"
}

# Create a custom route table
resource "alicloud_route_table" "example_route_table1" {
  route_table_name = "example_route_table1_name"
  vpc_id           = alicloud_vpc.example_vpc1.id
}

# Associate the route table with the vSwitch
resource "alicloud_route_table_attachment" "example_route_table_attachment1" {
  vswitch_id     = alicloud_vswitch.example_vsw1.id
  route_table_id = alicloud_route_table.example_route_table1.id
}

# Create a custom route table
resource "alicloud_route_table" "example_route_table2" {
  route_table_name = "example_route_table2_name"
  vpc_id           = alicloud_vpc.example_vpc2.id
}

# Associate the route table with the vSwitch
resource "alicloud_route_table_attachment" "example_route_table_attachment2" {
  vswitch_id     = alicloud_vswitch.example_vsw2.id
  route_table_id = alicloud_route_table.example_route_table2.id
}

# Create a VPC peering connection
resource "alicloud_vpc_peer_connection" "example_vpc_peer" {
  peer_connection_name = "example_vpc_peer_name"
  vpc_id               = alicloud_vpc.example_vpc1.id
  accepting_ali_uid    = "1234****" # The ID of the account that owns the peer VPC. This example creates a same-account peering connection. For cross-account peering, create an alicloud_vpc_peer_connection_accepter so the peer account accepts the request.
  accepting_region_id  = "cn-hangzhou"
  accepting_vpc_id     = alicloud_vpc.example_vpc2.id
}

# Configure a route for the peering connection
resource "alicloud_route_entry" "example_peer_route1" {
  route_table_id        = alicloud_route_table.example_route_table1.id
  destination_cidrblock = "30.0.0.0/16"
  nexthop_type          = "VpcPeer"
  nexthop_id            = alicloud_vpc_peer_connection.example_vpc_peer.id
}

# Configure a route for the peering connection
resource "alicloud_route_entry" "example_peer_route2" {
  route_table_id        = alicloud_route_table.example_route_table2.id
  destination_cidrblock = "10.0.0.0/16"
  nexthop_type          = "VpcPeer"
  nexthop_id            = alicloud_vpc_peer_connection.example_vpc_peer.id
}

# Create an IPv4 gateway
resource "alicloud_vpc_ipv4_gateway" "example_ipv4gw" {
  ipv4_gateway_name = "example_ipv4gw_name"
  vpc_id            = alicloud_vpc.example_vpc1.id
  enabled           = true
}

# Add a route pointing to the IPv4 gateway
resource "alicloud_route_entry" "example_igw_route" {
  route_table_id        = alicloud_route_table.example_route_table1.id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

Console

API

• Call AssociateRouteTableWithGateway to associate a gateway route table.

• Call DissociateRouteTableFromGateway to disassociate a gateway route table.

Terraform

Resource: alicloud_vpc_gateway_route_table_attachment

# Specify the region where the IPv4 gateway is deployed
provider "alicloud" {
  region = "cn-hangzhou"
}

# Specify the IPv4 gateway ID
variable "ipv4_gateway_id" {
  default = "ipv4gw-hp3v******" # Replace with the actual IPv4 gateway ID
}

# Specify the gateway route table ID
variable "route_table_id" {
  default = "vtb-hp3w******" # Replace with the actual gateway route table ID
}

# Associate the gateway route table
resource "alicloud_vpc_gateway_route_table_attachment" "example_attachment" {
  ipv4_gateway_id = var.ipv4_gateway_id
  route_table_id  = var.route_table_id
}