VPC is a logically isolated network space you can custom on the cloud. Similar to the traditional network running in your data center, services hosted within a VPC include CVMs, CLB, cloud databases, and more.
This document introduces the core components of a VPC, various connection methods, and security aspects of a VPC.
Core Components
A VPC has three core components: VPC IP range, subnet, and route table.
VPC IP Range
When you create a VPC, you need to use CIDR (Classless Inter-Domain Routing) to designate the IP address group for the VPC.
VPC supports IPv4 CIDR blocks in any of the following private IP ranges:
- 10.0.0.0-10.255.255.255 (The mask range must be between 16 and 28.)
- 172.16.0.0-172.31.255.255 (The mask range must be between 16 and 28.)
- 192.168.0.0-192.168.255.255 (The mask range must be between 16 and 28.)
- Non-standard IPv4 private IP ranges (The mask range must be between 16 and 28.)
Note:
From 2020-09-16, VPC started supporting non-standard IPv4 private IP ranges (which are not covered by the three major private IP ranges defined in RFC 1918). If needed, please submit a ticket to apply.
Subnet
A VPC consists of at least one subnet, and the CIDR of the subnet must be within the CIDR of the VPC.
A subnet is a network used to manage the network plane of elastic CVM and can provide services such as IP address management and DNS. All cloud resources in the VPC such as Cloud Virtual Machine (CVM), Cloud Database (CDB), etc. must be deployed in the subnet.
A VPC has region attributes (e.g., NCR), while a subnet has availability zone attributes (e.g., Availability Zone 1). Subnets within a VPC can belong to different availability zones within the same region. Resources within subnets of the same VPC can communicate with each other over a private network regardless of whether they are in the same availability zone or not.
Elastic CVMs in different VPCs can communicate by creating a peering connection.
Route Tables
A route table consists of multiple routing policies that control the outbound traffic direction of subnets in the VPC. Each subnet can only be associated with one route table, while each route table can be associated with multiple subnets. You can create multiple route tables for subnets with different traffic routes.
A route table controls traffic routes by using routing policies. A routing policy consists of the destination, next hop type, and next hop:
- Destination: Specifies the destination IP range to which you want to forward the traffic. It should be an IP range. If you want to enter a single IP address, set the mask to
32(for example,172.16.1.1/32). The destination cannot be an IP range of the VPC where the route table resides, because the local route already allows private network interconnection in this VPC. - Next hop type: Indicates the egress of data packets for the VPC. The next hop type of VPC supports NAT Gateway, Peering Connection, VPN Gateway, Direct Connect Gateway, CVM, and others.
- Next hop: Specifies the next hop instance (identified by the next hop ID) to which the traffic is forwarded, such as a NAT gateway in the VPC.
VPC Connection
The cloud platform offers a wide range of VPC connection solutions to meet different scenario needs:
- CVM and CloudDB instances in a VPC can connect to the public network via an EIP or NAT gateway.
- Through peering connections, different VPCs can communicate with each other.
- Through VPN connections, Direct Connect, VPCs, and local data centers can be interconnected.
- Through private links, VPCs are provided the ability to access other VPCs across accounts via the private network.
VPC Security
VPCs are logically isolated network spaces on the cloud, and different VPCs are isolated from each other, ensuring the security of your business:
- Security Group: A security group is a stateful virtual firewall for filtering packets. As an important means of network security isolation, it can be used to control the outbound and inbound traffic for instances.
- Network ACL: A network ACL is a stateless virtual firewall for filtering packets at the subnet level. It can be used to control the inbound and outbound data streams for subnets at the protocol and port granularities.
- Cloud Access Management (CAM): CAM provides secure management of access rights to all resources under a cloud account. Through CAM, you can manage the access rights to VPCs, for example, by controlling user access to VPCs through identity management and policy management.