SSL-VPN billing-VPN Gateway(VPN)-阿里云帮助中心

Using SSL-VPN incurs charges for the VPN gateway instance. Billing rules vary depending on the features enabled.

Billing

Features

Billable item

Billing method

Billing cycle

Estimated cost

SSL-VPN feature only

SSL-VPN instance fee
Bandwidth fee
SSL specification fee

Subscription

You prepay for resources on a monthly or yearly basis.

Note

VPN Gateway instances do not support the pay-as-you-go billing method.

1 month

Use the Pricing Calculator to estimate costs for the SSL-VPN feature.

SSL-VPN and IPsec-VPN features

IPsec-VPN instance fee
SSL-VPN instance fee
Bandwidth fee
SSL specification fee

Billable items

Important

The following table shows the pricing for public cloud regions only. For information about the pricing for Alibaba Finance Cloud and Alibaba Gov Cloud, see the purchase page.
- If the prices on the public cloud purchase page differ from the prices in this table, the prices on the purchase page prevail.
- In the China (Nanjing - Local Region) and China (Fuzhou - Local Region) regions, the maximum bandwidth for a VPN Gateway instance is 500 Mbps.
  Click to view the regions in the Chinese mainland.
  China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Nanjing - Local Region), China (Fuzhou - Local Region), China (Wuhan - Local Region), China (Shenzhen), China (Heyuan), China (Guangzhou), and China (Chengdu)
"Not supported" indicates that the VPN Gateway instance in the specified region does not support the corresponding bandwidth specification.

IPsec-VPN instance fee

The following table describes the pricing of IPsec-VPN instances for different regions and bandwidth specifications. Unit: CNY per month.

Region	5 Mbps	10 Mbps	20 Mbps	50 Mbps	100 Mbps	200 Mbps	500 Mbps	1000 Mbps
The Chinese mainland	250	250	1080	1080	1080	1080	2080	2080
China (Hong Kong)	340	340	1030	1030	1030	1440	2780	2780
Singapore	340	340	1030	1030	1030	1440	2780	2780
Japan (Tokyo)	360	360	1080	1080	1080	1080	2080	2080
South Korea (Seoul)	360	360	1080	1080	1080	1080	2080	2080
Thailand (Bangkok)	340	340	1030	1030	1030	1440	2780	2780
Philippines (Manila)	340	340	1030	1030	1030	1440	2780	2780
Malaysia (Kuala Lumpur)	330	330	990	990	990	990	2380	2380
Indonesia (Jakarta)	340	340	1030	1030	1030	1030	1990	1990
US (Virginia)	260	260	1160	1160	1160	1160	2240	2240
US (Silicon Valley)	320	320	1540	1540	1540	1540	2970	2970
Germany (Frankfurt)	500	500	2160	2160	2160	2160	2720	2720
UK (London)	300	300	1410	1410	1410	1410	2720	2720
Mexico	260	260	1160	1160	1160	1160	2240	2240
UAE (Dubai)	370	370	1730	1730	1730	1730	3340	Not supported

SSL-VPN instance fees

This table shows the monthly prices in CNY for SSL-VPN instances by region and bandwidth.

Region	5 Mbps	10 Mbps	20 Mbps	50 Mbps	100 Mbps	200 Mbps	500 Mbps	1000 Mbps
The Chinese mainland	250	250	1080	1080	1080	1080	2080	2080
China (Hong Kong)	340	340	1030	1030	1030	1440	2780	2780
Singapore	340	340	1030	1030	1030	1440	2780	2780
Japan (Tokyo)	360	360	1080	1080	1080	1080	2080	2080
South Korea (Seoul)	360	360	1080	1080	1080	1080	2080	2080
Thailand (Bangkok)	340	340	1030	1030	1030	1440	2780	2780
Philippines (Manila)	340	340	1030	1030	1030	1440	2780	2780
Malaysia (Kuala Lumpur)	330	330	990	990	990	990	2380	2380
Indonesia (Jakarta)	340	340	1030	1030	1030	1030	1990	1990
US (Virginia)	260	260	1160	1160	1160	1160	2240	2240
US (Silicon Valley)	320	320	1540	1540	1540	1540	2970	2970
Germany (Frankfurt)	300	300	1410	1410	1410	1410	2720	2720
UK (London)	300	300	1410	1410	1410	1410	2720	2720
Mexico	260	260	1160	1160	1160	1160	2240	2240
UAE (Dubai)	370	370	1730	1730	1730	1730	3340	Not supported

SSL specification pricing

After you enable SSL-VPN, you must select a specification for the number of SSL-VPN connections based on the maximum number of concurrent clients. The following table describes the pricing for each specification. Unit: CNY per month.

Number of SSL-VPN connections	Price
5	188
10	288
20	458
50	888
100	1288
200	2288
500	4288
1000	6088

Bandwidth fee

The following table describes the bandwidth pricing for different regions and bandwidth specifications. Unit: CNY per month.

Region	5 Mbps	10 Mbps	20 Mbps	50 Mbps	100 Mbps	200 Mbps	500 Mbps	1000 Mbps
The Chinese mainland	125	525	1325	3725	7725	15725	39725	79725
China (Hong Kong)	150	650	1650	4650	9650	19650	49650	99650
Singapore	115	515	1315	3715	7715	15715	39715	79715
Japan (Tokyo)	125	545	1385	3905	8105	16505	41705	83705
South Korea (Seoul)	125	525	1325	3725	7725	15725	39725	79725
Thailand (Bangkok)	115	515	1315	3715	7715	15715	39715	79715
Philippines (Manila)	115	515	1315	3715	7715	15715	39715	79715
Malaysia (Kuala Lumpur)	115	515	1315	3715	7715	15715	39715	79715
Indonesia (Jakarta)	125	525	1325	3725	7725	15725	39725	79725
US (Virginia)	150	650	1650	4650	9650	19650	49650	99650
US (Silicon Valley)	150	650	1650	4650	9650	19650	49650	99650
Germany (Frankfurt)	115	515	1315	3715	7715	15715	39715	79715
UK (London)	115	515	1315	3715	7715	15715	39715	79715
Mexico	150	650	1650	4650	9650	19650	49650	99650
UAE (Dubai)	575	2015	4895	13535	27935	56735	143135	Not supported

Billing example

As shown in the preceding figure, an enterprise client in the Chinese mainland connects to a VPC via SSL-VPN. Suppose you have a VPN Gateway with only the SSL-VPN feature enabled, a bandwidth of 10 Mbps, and support for a maximum of 5 SSL connections. Fees for the one-month period from 00:00:00, June 01, 2023 to 00:00:00, July 01, 2023 are calculated as follows:

SSL-VPN connection fee = CNY 250/month × 1 month = CNY 250
SSL specification fee = CNY 188/month × 1 month = CNY 188
Bandwidth fee = CNY 525/month × 1 month = CNY 525
Total fees = SSL-VPN connection fee + SSL specification fee + Bandwidth fee = CNY 963

Modify or renew a VPN gateway instance

To modify the bandwidth or features of a VPN gateway instance, you can upgrade, downgrade, perform a temporary upgrade, or renew the instance with a configuration change. If you only need to extend the subscription period, you can renew the instance.

Upgrade

Item	Description
Upgrade capabilities	Increase the bandwidth specification of a VPN gateway instance. Enable IPsec-VPN and SSL-VPN features for a VPN gateway instance. Increase the SSL connection limit of a VPN gateway instance.
Upgrade limitations	You must pay for or cancel any unpaid orders for the VPN gateway instance before you can upgrade it. If the bandwidth of a VPN gateway instance is 200 Mbps or less, you cannot upgrade it to 500 Mbps or 1000 Mbps. If the bandwidth is 500 Mbps, you can only upgrade it to 1000 Mbps. The upgrade process does not interrupt your services.
Effective time	The new configuration takes effect immediately after the upgrade, although network latency might cause a short delay.
Billing impact	After you submit an upgrade order, you must pay the price difference for the remainder of the current billing cycle. The actual price is displayed on the console.
Scenarios	If the current specifications of the VPN gateway instance no longer meet your business needs, you can upgrade the instance.

Log on to the VPN Gateway console.
In the top navigation bar, select the region where the VPN gateway instance resides.
On the VPN Gateways page, find the target VPN gateway instance and click Upgrade in the Bandwidth column.
On the page that opens, change the configuration of the VPN gateway instance.
You can increase the bandwidth specification, enable IPsec-VPN or SSL-VPN, or increase the SSL connection limit as needed.
In the Terms of Service section, read and select the terms of service. Then, click Buy Now and complete the payment.

Downgrade

Item	Description
Downgrade capabilities	Decrease the bandwidth specification of a VPN gateway instance. Disable IPsec-VPN and SSL-VPN features for a VPN gateway instance. Decrease the SSL connection limit of a VPN gateway instance.
Downgrade limitations	If the VPN gateway instance has unpaid orders, pay for or cancel them before downgrading. To disable IPsec-VPN during a downgrade, ensure no IPsec-VPN connections exist under the instance. To delete an IPsec connection, see IPsec connections (attached to a VPN gateway). To disable SSL-VPN during a downgrade, ensure no SSL servers or IPsec servers exist for the instance. To delete SSL and IPsec servers, see Delete an SSL server and Delete an IPsec server. Bandwidth limits: VPN gateway instances in dual-tunnel mode have no bandwidth downgrade restrictions. For VPN gateway instances in single-tunnel mode: if the bandwidth is 1000 Mbps, you can only downgrade to 500 Mbps. If the bandwidth is 500 Mbps, you cannot downgrade it. During a bandwidth downgrade, if traffic exceeds the new bandwidth limit, connections may break. Ensure your backend applications support reconnection. When decreasing the SSL connection limit, if connected clients exceed the new limit, connections may break. Ensure your backend applications support reconnection.
Effective time	The new configuration takes effect immediately after the downgrade, although network latency might cause a short delay.
Billing impact	A downgrade may generate a refund. The refund amount is the difference between the cost of the new configuration for the remaining subscription period and the remaining value of the previous configuration. The remaining value is affected by discounts and coupons that were applied at the time of purchase. The actual amount is displayed on the order page. For more information, see Unsubscription rules.
Scenarios	If the current specifications of the VPN gateway instance exceed your business needs, you can downgrade the instance.

Log on to the VPN Gateway console.
In the top navigation bar, select the region where the VPN gateway instance resides.
On the VPN Gateways page, find the target VPN gateway instance and click Downgrade in the Bandwidth column.
On the page that opens, change the configuration of the VPN gateway instance.
You can decrease the bandwidth specification, disable IPsec-VPN or SSL-VPN, or decrease the SSL connection limit as needed.
In the Terms of Service section, read and select the terms of service. Then, click Buy Now and complete the payment.

Temporary upgrade

Item	Description
Temporary upgrade limitations	If the VPN gateway instance has a pending renewal with specification change, you cannot perform a temporary upgrade. If the instance has unpaid orders, pay for or cancel them before performing a temporary upgrade. The minimum duration for a temporary upgrade is 48 hours. Before the reversion time, you cannot downgrade or request a refund. Choose the reversion time carefully. A temporary upgrade only supports enabling IPsec-VPN or SSL-VPN. You cannot disable these features during a temporary upgrade. Warning When the reversion time arrives, the VPN gateway instance automatically reverts to its pre-upgrade configuration. The reversion process does not interrupt services. However, reducing bandwidth may cause transient disconnections or throttling, which can drop traffic. Ensure your backend applications support reconnection.
Effective time	The new configuration takes effect immediately after you perform a temporary upgrade on the VPN gateway instance. However, the process may be delayed due to network latency. Please wait a few minutes.
Billing impact	After you submit a temporary upgrade order, you must pay the price difference for the upgrade duration. Temporary upgrades are billed hourly, based on monthly feature prices. After you select the new configuration and set the restore time on the temporary upgrade page, the console automatically calculates and displays the total price based on hourly rates.
Scenarios	Use a temporary upgrade to handle traffic bursts for a limited period.

Log on to the VPN Gateway console.
In the top navigation bar, select the region where the VPN gateway instance resides.
On the VPN Gateways page, find the VPN gateway instance. In the Actions column, choose Temporary Upgrade.

On the Temporary Upgrade page, set the following parameters.

Configuration	Description
Bandwidth	Select a new bandwidth specification.
IPsec-VPN	Select whether to enable IPsec-VPN.
SSL-VPN	Select whether to enable SSL-VPN.
SSL-VPN Connections	Select the SSL connection limit. Note You can configure this only after enabling SSL-VPN.
Restore Time	Set the time to revert the temporary upgrade.

In the Terms of Service section, read and select the terms of service. Then, click Buy Now and complete the payment.

Renew with configuration change

Item	Description
Capabilities	This option allows you to renew a VPN gateway instance and simultaneously modify its configuration for the next billing cycle. For example, you can change the bandwidth, modify the number of SSL connections, and enable or disable the IPsec-VPN and SSL-VPN features.
Limitations	If the VPN gateway instance has unpaid orders, you must pay for or cancel them before you can renew the instance with a specification change. After you submit a renewal with specification change order, you cannot perform a temporary upgrade before the new subscription period starts. During a bandwidth downgrade, if traffic exceeds the new bandwidth limit, connections may be interrupted. Ensure that your backend applications support reconnection. When you decrease the SSL connection limit, if the number of connected clients exceeds the new limit, connections may be interrupted. Ensure that your backend applications support reconnection.
Effective time	The new configuration takes effect at the start of the next billing cycle. The current configuration remains active until then.
Billing impact	After you submit the order, you are billed based on the new configuration and subscription duration.
Scenarios	If a VPN gateway instance is about to expire and its specifications must be changed for the next billing cycle, you can renew it with a configuration change.

Log on to the VPN Gateway console.
In the top navigation bar, select the region where the VPN gateway instance resides.
On the VPN Gateways page, find the VPN gateway instance. In the Actions column, choose Renew and Upgrade/Downgrade.

On the Renew with Specification Change page, set the following parameters.

Configuration	Description
Billing Cycle	Select the renewal duration.
Bandwidth	Select a new bandwidth specification.
IPsec-VPN	Select whether to enable or disable IPsec-VPN.
SSL-VPN	Select whether to enable or disable SSL-VPN.
SSL-VPN Connections	Select the SSL connection limit. Note You can configure this only after enabling SSL-VPN.

In the Terms of Service section, read and select the terms of service. Then, click Buy Now and complete the payment.

Renew

If an instance's current configuration meets your needs and is about to expire, you can renew it to extend the subscription period and prevent service interruptions.

In the VPN Gateway console

Log on to the VPN Gateway console.
In the top navigation bar, select the region where the VPN gateway instance resides.
On the VPN Gateway page, find the target VPN gateway instance and click Renew in the Actions column.
On the Renewal page, select a renewal duration.
In the Terms of Service section, read and select the terms of service. Then, click Buy Now and complete the payment.

In the Expenses and Costs console

Log on to the VPN Gateway console.
In the top navigation bar, hover over Expenses and click Manage Renewal.
On the Manage Renewal page, find the VPN gateway instance.
On the Manual Renewal, Auto-renewal, or Nonrenewal upon Expiration tab, find the instance and select a renewal option.
For more information, see Renew expiring resources.

Bills

Log in to the Alibaba Cloud Expenses and Costs console. In the left-side navigation pane, choose Billing > Bill Details to view bill details.

Overdue payments

If the available balance in your account, including your Alibaba Cloud account balance, vouchers, and coupons, is insufficient to cover an outstanding bill, your account is considered overdue. The system will then send a text message and an email reminder to pay the bill.

VPN Gateway instances are subscription-based resources paid for in advance. If your account is overdue but the VPN Gateway instance has not expired, you can continue to use it. However, you cannot perform operations that incur fees, such as purchasing a new VPN Gateway instance, upgrading its configuration, or renewing it. After the instance expires, you can no longer use it. If you do not renew the instance within a specified period, it will be automatically released.

Immediately after your VPN Gateway instance expires, its service is suspended. For 7 days after expiration, the service is suspended and forwards no traffic, while the system retains the instance configuration. During this period, you can add funds and complete a renewal. Upon successful renewal, the instance resumes normal operation.
If the instance is not renewed within the 7-day suspension period, it is released. After the instance is released, its configuration and data are permanently deleted and unrecoverable.

Refunds

You can cancel a VPN Gateway instance if you no longer need it. For information about refunds, see Refund Rules and Procedures.