Tenant Cloud Network Direct Connect Product Introduction

Product Features

Last Updated At: 2025-10-21 09:10:00

Connection

The physical line connection between the cloud platform and the local data center. You can use a third-party network service provider to establish a network connection between your data center and the cloud platform's dedicated network connection point.

DC Tunnel

  • A DC tunnel is a network link division of a connection.
  • You can create DC tunnels connected to different DC gateways to interconnect your local data center with multiple VPCs.

Network Address Translation (NAT)

NAT is a solution to the IP conflict problem at both ends of the DC during the connection to a hybrid cloud. You can configure NAT rules on the DC gateway. NAT includes IP translation and IP port translation.

IP Translation

  • IP translation refers to translating the original IP to a new IP to achieve mutual network access. It is divided into local IP translation and peer IP translation.
  • IP translation does not distinguish between source and destination directions. The mapped IP can actively access the peer end or be actively accessed by the peer end.

Local IP translation

1. Note for Conversion

  • Local IP translation refers to mapping the original IP in the VPC to a new IP, and using the new IP to communicate with the DC peer.

  • You can configure multiple local IP translation rules and configure a network ACL for each local IP translation rule. The network ACL supports configuration of the source port, destination IP, and destination port.

    Note:

    Network address translation rules are effective only for network requests that comply with ACL restrictions.

  • The local IP translation does not limit the direction of the network request. It can be the VPC actively accessing the DC peer, or the other way round.

2. Example of Conversion

Inside the VPC, IP A 192.168.0.3 is mapped to IP B 10.100.0.3, then the source IP for IP A's active access to the DC peer will be automatically modified to 10.100.0.3, and all network packets accessed by the DC peer 10.100.0.3 will automatically be directed to IP A 192.168.0.3.

Peer IP translation

1. Note for Conversion
  • Peer IP translation means that the original IP in the user's IDC is mapped to a new IP, and the new IP is used to communicate with the IP in the VPC.
  • Unlike local IP translation, peer IP translation does not support network ACL restrictions. Therefore, once a peer IP translation rule is configured, it will take effect on all DC tunnel peers.
  • The peer IP translation does not limit the direction of the network request. It can be the VPC actively accessing the DC peer, or the other way round.

2. Example of Conversion

Dedicated line peer IP D 10.0.0.3 is mapped to IP C 172.16.0.3, then IP D 10.0.0.3 actively accesses the source IP of the network packet of the VPC and will be automatically modified to IP C 172.16.0.3. All the VPC's network packets accessing IP C 172.16.0.3 will automatically be directed to the DC peer IP D 10.0.0.3.

Note:

  • After the local IP translation and peer IP translation are configured, the DC gateway will only send the translated IP route to the DC peer. Therefore, the original IP that is not configured with the local and peer IP translation will not be able to ping the DC peer. However, DC gateways cannot replace professional network firewalls. If you need advanced network protection, configure security groups and network ACL policies in the VPC and deploy professional physical network firewall devices in your IDC computer room.
  • When the DC gateway is configured with peer IP translation, in the destination IP of the local source IP port translation ACL rule field, you need to fill in the mapped IP of the peer IP translation, instead of the original IP.

IP Port Translation

  • IP port translation refers to mapping the original IP port to a new IP port and using the new IP port to achieve network access. IP port translation includes local source IP port translation and local destination IP port translation.
  • IP port translation emphasizes directionality. Source IP port translation refers to active outbound access, and destination IP port translation refers to active access by the peer end.

Local Source IP Port Translation

1. Note for Conversion
  • Local source IP port translation means that when an IP in a VPC actively accesses a public network through a DC gateway, a random port of a random IP in a specified IP pool is used to access the user IDC at the DC peer.
  • Local source IP port translation supports configuration of ACL rules. Only network outbound access that complies with the ACL rules matches the address pool forwarding rules. By configuring different ACL rules for the address pool, you can flexibly configure network address translation rules for multiple third-party connection.

  • The local source IP port translation only supports the network access request initiated by the VPC end. If the DC peer needs to actively access the IP port in the VPC, the local destination IP port translation configuration needs to be additionally configured. The network requests initiated by the local source IP port translation within the VPC are considered stateful connections, thus eliminating the need to address network packet return issues.
2. Example of Conversion

The IP range of VPC C is 172.16.0.0/16. Third-party banks A and B are connected via a DC, where Bank A's peer IP range is 10.0.0.0/28, requesting the connecting IP range to be 192.168.0.0/28; Bank B's peer IP range is 10.1.0.0/28, requesting the connecting IP rage to be 192.168.1.0/28. Then you can configure two local source IP port translations as follows:

  • Address pool A 192.168.0.1 - 192.168.0.15; ACL rule A; source IP 172.16.0.0/16; destination IP 10.0.0.0/28; destination port ALL.
  • Address pool B 192.168.1.1 - 192.168.1.15; ACL rule B; source IP 172.16.0.0/16; destination IP 10.1.0.0/28; destination port ALL.
    Then, the network requests that actively access A and B in the VPC are translated into random ports in the corresponding address pools according to ACL rules A and B, and access the corresponding DC tunnels.

Local Destination IP Port Translation

1. Note for Conversion

  • The local destination IP port translation is a method for the DC peer to actively access the VPC. The designated port of the designated IP in the VPC is mapped to a new IP and port. The DC peer can only communicate with the designated IP port in the VPC by accessing the mapped IP port, and other IP ports are not exposed to the DC peer.

  • The local destination IP port translation does not support ACL rule adaptation. Therefore, the IP port translation rules will take effect on all DC tunnels connected to the DC gateway. The local destination IP port translation is only effective for the DC tunnel peer to actively access the VPC. If the VPC needs to actively access the DC peer, you can configure the local source IP port translation.

2. Example of Conversion

The IP range of VPC C is 172.16.0.0/16 If you only want to open some ports for active access by the DC peer, you can configure them as follows:

  • Mapping A original IP port 172.16.0.1:80; Mapping IP port 10.0.0.1:80.
  • Mapping B original IP port 172.16.0.0:8080; mapped IP port 10.0.0.1:8080.
    Then the DC peer can actively access ports 10.0.0.1:80 and 10.0.0.1:8080, to achieve active access to the two ports 172.16.0.1:80 and 172.16.0.0:8080 in the VPC.

Note:

  • After the local source and destination IP port translation are configured, the DC gateway will only send the translated IP port route to the DC peer. Therefore, the unconfigured local IP port will not be able to actively initiate requests or passively accept requests. However, DC gateways cannot replace professional network firewalls. If you need advanced network protection, configure security groups and network ACL policies in the VPC and deploy professional physical network firewall devices in your IDC computer room.
  • When IP translation and IP port translation are configured at the same time, IP translation is matched first. When there is no matching option for IP translation, IP port translation is matched.
  • When the DC gateway is configured with peer IP translation, in the destination IP of the local source IP port translation ACL rule field, you need to fill in the mapped IP of the peer IP translation, instead of the original IP.