Tenant Cloud Network VPN Connections Product Introduction

Limits

Last Updated At: 2025-10-21 09:10:00

IPsec VPN Usage Limitations

When you use an IPsec VPN connection, you need to pay attention to the following:

  • After the VPN parameters are configured, you need to add a routing policy pointing to the VPN gateway in the subnet-associated routing table, and the network request from the CVM in the subnet to access the peer IP range is transmitted to the customer gateway through the VPN channel.
  • After the routing table is configured, you need to ping the IP in the peer IP range from the CVM in the VPC to activate the VPN channel.
  • The stability of VPN connections depends on the quality of the operator's public network.
  • The resource limits are as follows:
Resources Limit (pcs) can request for high quota
Number of VPN gateways per VPC 10 No
Number of customer gateways in the same region 20 No
Number of VPN channels supported by the same customer gateway 10 No
Number of VPN channels that can be created on the same VPN gateway 20 No
Number of SPDs per VPN channel 10 No
Number of peer IP ranges supported by each SPD 50 No

Note:

  • The number of VPN tunnels supported by the same customer gateway is an account-level Quota .
  • Only one VPN tunnel can be established between the same customer gateway and a VPN gateway within a VPC.

The customer gateway does not support the following IP addresses:

  • All 0s, all 255s, or a multicast address starting with 224.

  • Loopback Address: 127.xxx/8.

  • An IP in which the host bits are all 0 or all 1, for example:

  • For example, in the A category, an IP starting with 1 - 126 is 1 - 126.0.0.0 and 1 - 126.255.255.255.

  • For example, in the B category, an IP starting with 128 - 191 is 128 - 191.x.0.0 and 128 - 191.x.255.255.

  • For example, in the C category, an IP starting with 192 - 223 is: 192 - 223.xx0 and 192 - 223.xx255.

  • Internal Service Address: 169.254.xx/16.

SSL VPN usage limitations

SSL Client Constraints:

  • The SSL VPN client uses the open source OpenVPN for docking, and users need to download OpenVPN themselves.

  • The SSL VPN client must support Windows, Mac, and Linux (mainstream versions) systems.

  • The client and server must perform two-way certificate authentication. The client's certificate and key are requested for and downloaded from the cloud, and the configuration file is provided for download.

  • The client certificate SNI is the SSL VPN instance ID (SSL VPN client instance ID).
    SSL Server Constraints:

  • The server must perform two-way certificate authentication. The root certificate and server certificate are valid for 10 years, and the client certificate is valid for 3 years.

  • Only one client IP address pool can be configured.

  • Can access one VPC-side CIDR.

  • The maximum number of connections, supporting 5, 10, 20, 50, 20, and 100.
    SSL VPN Gateway Constraints:

  • The client communicates with the VM in the VPC through the SSL VPN gateway. Currently, SSL VPN only connects to the OpenVPN client.

  • EIP opens UDP port 1194 to provide SSL VPN services.

  • When different users use the same certificate and key to communicate with the SSL VPN gateway, only one user can establish an SSL VPN connection with the SSL VPN gateway at the same time. If two users keep trying to establish a connection, neither of them can establish a connection.