The number of VPN gateways supported within the same VPC is limited by the quota item "number of VPN gateways allowed per account per region." By default, if there is only one VPC in the target account, a maximum of 5 VPN gateways can be created under that VPC.

Can a single VPN gateway establish multiple IPsec-VPN connections?

Yes. A single VPN gateway can establish up to 10 IPsec-VPN connections.

Is it necessary to purchase additional public IP addresses when using a VPN attachment?

No. When using a VPN attachment, after the VPN gateway is created, the system automatically assigns a public IP address to the VPN gateway as its egress IP address. Therefore, you do not need to purchase additional public IP resources.

Will the egress IP address assigned by the system be retained after deleting the VPN gateway?

No. The egress IP address is a public IP address automatically assigned by the system when creating the VPN gateway, and its lifecycle follows the VPN gateway. After you delete the VPN gateway, all resources associated with it and related configuration information will be released.

What is the relationship between a VPC and a VPN gateway?

The VPN gateway is deployed on the VPC and connects all resources within the VPC.

How does a VPN attachment plan the network addresses of a VPC?

When using the VPN attachment feature to establish a connection between an on-premises data center and a Virtual Private Cloud (VPC), make sure the subnet of the on-premises data center does not overlap or match the subnet of the VPC where the VPN gateway is located.

What is the priority of the VPN gateway route compared to other routes?

VPN gateway route entries and other route entries only differ in priority based on the destination address mask. The larger the mask, the higher the priority.

When the route table contains custom route entries with the same next hop type and overlapping target subnets, traffic is forwarded following the Longest Prefix Match (LPM) principle.

Can a VPN gateway have multiple routes added?

Yes. A VPN gateway supports creating up to 20 route entries.

Can the local VPN gateway routes overlap with the peer gateway routes?

No. When using VPN Connect to link a VPC with an on-premises data center or another VPC, configuring the VPN gateway route with overlapping CIDR blocks between the VPN gateway route and the private CIDR blocks of the data center or other VPC will create a routing loop at the VPN gateway. This causes routes published on the VolcanoEngine VPN gateway to loop back directly to the VPN gateway, resulting in network connectivity failure between both ends of the VPN connection.

For example, if the VPN gateway CIDR block is 10.0.1.0/24 and the private CIDR blocks of the on-premises IDC or other VPCs are 10.0.2.0/24 and 10.0.3.0/24, you must not configure a large CIDR block including 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24, such as 10.0.0.0/8, in the VPN gateway route.

You should configure route entries on the VPN gateway with the next hop set to the IPsec-VPN connection, where the peer CIDR blocks of the IPsec-VPN connection are 10.0.2.0/24 and 10.0.3.0/24.

Why is the measured traffic lower than the bandwidth specification of the VPN gateway?

When using VPN Connect, if the actual service data traffic significantly exceeds the bandwidth specification of the VPN gateway, the sequence number order of the service data packets may differ greatly from the normal order. The anti-replay detection will treat this as packet replay and actively discard some data packets, causing the measured traffic to be lower than the VPN gateway's bandwidth specification.

Will the IPsec-VPN connection automatically reconnect after renewing the Subscription when the Subscription VPN gateway expires and shuts down?

No. An IPsec-VPN connection disconnects when the VPN gateway expires and shuts down. After renewing the VPN gateway subscription, please refer to the following steps to reconnect the IPsec-VPN connection.

Method 1

When the peer (on-premises data center or other VPC) actively initiates IKE SA and IPsec SA, then executes the Ping command to access the VPC or when data passes through, the IPsec tunnel is triggered to re-establish the connection.

Method 2

Find the IPsec-VPN connection associated with the VPN gateway to be renewed in the IPsec-VPN connection list, click the Modify button on the right side to enter the edit page.

No information needs to be changed; click the Authorize button.

When the Ping command is executed to access the VPC or when data passes through, the IPsec tunnel is triggered to re-establish the connection.

What new features do different versions of the VPN gateway support?

The features supported by different versions of the VPN gateway vary. For new features supported by each version, see New feature release notes.

tip

Previous versions that have not been upgraded do not support features introduced in later versions. To use new features, upgrade the VPN gateway to the latest version. For details, see Upgrading a VPN gateway.

Why are the routes configured on the VPN gateway not pushed to all route tables of the associated VPC?

Issue cause

Route entries added on the VPN gateway only apply to the system route table of the VPN gateway’s host VPC. They do not apply to the custom route table of that VPC. Therefore, if the VPN gateway’s host VPC has a custom route table, traffic from subnets associated with this custom route table cannot be forwarded to the VPN gateway.

Solution

If traffic from a subnet associated with a custom route table needs to be forwarded to the VPN gateway, you can manually add a route entry in the custom route table. Set the destination CIDR to the peer network segment (on-premises data center or other VPC) and the next hop to the VPN gateway to forward the subnet traffic to the VPN gateway. For detailed steps, refer to Add route.

How to check the VPN gateway’s egress IP address?

After the VPN gateway is created, the system automatically assigns a public IP address as the VPN gateway's egress IP. You can view the egress IP in the VolcanoEngine VPN gateway console.

Procedure

Log in to the VPN gateway console, then select the target region and project of the VPN gateway in the top navigation bar.

In the VPN gateway list, the IP address column of the target VPN gateway shows the VPN gateway's egress IP.

Why did the configured bandwidth monitoring alert not trigger when the VPN gateway bandwidth exceeded its limit?

The bandwidth limit of the VPN gateway applies to the traffic of encapsulated encrypted packets, while the bandwidth monitoring alert metrics actually collect the sum of the inbound and outbound IPsec traffic of the VPN gateway, which is the traffic of the original packets before encapsulation. This causes the CloudMonitor alert not to trigger when the actual inbound and outbound VPN gateway traffic exceeds the bandwidth limit.

To avoid this issue, when configuring alarm policies to monitor VPN gateway metrics on the CloudMonitor platform, select monitoring metrics that include packet encapsulation overhead for the trigger condition, such as: VPN gateway outbound/inbound bandwidth utilization.

Last updated: 2026.07.15 18:21:41