Docs

Elastic Compute Service

FAQ

Network FAQ

Category	Question
VPC	Which CIDR blocks are supported by VPC? How many available IP addresses are there in each CIDR block? How does a VPC ensure the security of ECS instances? Can I change the VPC for an ECS instance? Can different VPCs communicate with each other?
Network interface	How do I distinguish the primary network interface and the secondary network interface? Is there a limit on the number of network interfaces mounted to an ECS instance? Must the ECS instance and the secondary network interface to be mounted belong to the same VPC? Why is the network of a secondary network interface unreachable after I mount the secondary network interface to an instance? Why does access to the public network fail after I mount a secondary network interface to a Windows ECS instance? Can I change the EIP and private IP address of a network interface? Can I unmount the primary network interface? What should I do if I fail to unmount a network interface? Why is an incorrect IP address displayed on a Windows instance after I mount, uninstall, or disable a network interface and perform other operations?
Security group	How do I plan security groups appropriately? How do I open a port? What are the common ports for ECS instances? How do I open port 25? What should I do if specific ports cannot be accessed?/What are the high-risk ports? How to view which ports are opened on an ECS instance? How do I change the security groups for an ECS instance? What are the differences between a security group and the Windows Firewall? Why is a Windows instance with an associated EIP still unable to communicate with the public network even after the security group rules are configured to allow traffic? How can I see whether ports enabled in a security group take effect? Why can't I access services deployed on an ECS instance after I configure the security group for the instance?
EIP	How to view the IP address of an ECS instance? How can I view the price of an EIP instance? How do I view the EIP bandwidth of an instance? How do I modify the configuration of the EIP associated with an ECS instance? How do I change the EIP of an ECS instance? What changes will occur to the bandwidth when a pay-as-you-go EIP is added to a shared bandwidth package? What is the range of the bandwidth upper limit for a shared bandwidth package? Why does an ECS instance remain unable to connect to the Internet after being associated with an EIP? Why is the access latency of an ECS instance high?

Virtual Private Cloud

Which CIDR blocks are supported by Virtual Private Cloud (VPC)? How many available IP addresses are there in each CIDR block?

VPC supports two deployment modes: IPv4 single-stack and dual-stack (IPv4 & IPv6). ECS instances within a VPC can communicate via IPv4 (32-bit address length) or IPv6 (128-bit address length) addresses, with IPv4 and IPv6 being mutually independent.

The following table describes the IPv4 CIDR blocks supported by VPC and the number of available IP addresses in each CIDR block.

CIDR block	Number of IP addresses in the VPC (excluding IP addresses reserved by the system)
10.0.0.0/8~24	16777213
172.16.0.0/12~24	1048573
192.168.0.0/16~24	65533
172.31.0.0/16 (reserved for the default VPC)	65533

Since IPv6 addresses on the Volcano Engine platform are globally unique, the IPv6 CIDR blocks are automatically assigned by the system to avoid conflicts. The subnet mask of a VPC CIDR block is fixed at /56, and that of each subnet CIDR block is fixed at /64.

tip

Dual-Stack VPC is currently in beta. Only accounts that have completed enterprise authentication can apply for a trial. If you need a trial, contact your account manager.

How does a VPC ensure the security of ECS instances?

A VPC is a logically isolated network environment. Direct communication is not possible between different VPCs, nor between a VPC and the public network. Other products are required for the communication.

The network interface of an ECS instance must be associated with a security group of the VPC. The security group controls the inbound and outbound traffic of the network interface. By default, all traffic is denied. You need to configure specific rules to allow traffic.

You can configure network access control lists (ACLs) for subnets in a VPC based on your needs to control the traffic of the subnets.

tip

To facilitate user experience, the system automatically adds specific rules to security groups and network ACLs to allow traffic. You can modify the rules based on your needs.

Can I change the VPC for an ECS instance?

Yes, you can. For more information, see Changing VPC or subnet.

Can different VPCs communicate with each other?

By default, different VPCs are fully isolated from one another. However, interconnection between them can be achieved using specific products.

Product	Description	Same account, same region	Cross-account, same region	Same account, cross-region	Cross-account, cross-region
Cloud Enterprise Network (CEN)	Complete private network interconnection among multiple VPCs is achieved on the cloud.	Supported. For more information, see Same account, same region VPC interconnection.	Supported. For more information, see Cross-account, same-region VPC interconnection.	Supported. For more information, see Same account, cross-region VPC interconnection.	Supported. For more information, see Cross-account, cross-region VPC interconnection.
Transit Router (TR)	Flexibly define connectivity and isolation between multiple VPCs.	Supported. For more information, see Implementing private connectivity and segmentation between VPCs (same account, same region).	Supported. For more information, see Implementing private connectivity and segmentation between VPCs (cross-account, same region).	Supported. For more information, see Implementing private connectivity and segmentation between VPCs (same account, cross-region).
PrivateLink	Resources within a VPC can securely and easily access services shared by other VPCs.	Supported. For more information, see Implementing private access between VPCs within the same account.	Supported. For more information, see Implementing private access between VPCs across accounts.	Native support is not available, but cross-region access can be achieved by using other products.
VPN connection	Complete interconnection between two VPCs is achieved.	Supported. For more information, see Establishing network connectivity between VPCs.

Network interface

How do I distinguish the primary network interface and the secondary network interface?

Primary network interface: When you create an ECS instance, the primary network interface is created by default along with the ECS instance. You cannot unmount the primary network interface from the ECS instance.

Secondary network interface: A network interface that can be independently created, flexibly mounted, and unmounted.

To distinguish between the primary network interface and the secondary network interface of an ECS instance, perform the following steps:

In the top menu bar, select a target region.

In the left-side navigation pane, click "Instances".

Click the name of the target ECS instance.

Select the "Network Interface" tab. You can distinguish between the primary network interface and the secondary network interface from the "Type" column in the list.

Is there a limit on the number of network interfaces mounted to an ECS instance?

There is a limit on the number of network interfaces mounted to an ECS instance. The limit varies based on the ECS instance type. For more information, see Instance type list.

Must the ECS instance and the secondary network interface to be mounted belong to the same VPC?

They must belong to the same VPC. However, you can mount secondary network interfaces from different subnets to an ECS instance to segment traffic.

Why is the network of a secondary network interface unreachable after I mount the secondary network interface to an instance?

Possible causes are as follows:

Cause	Description
Images fail to recognize secondary network interfaces.	After you mount a secondary network interface to an ECS instance, some images cannot automatically recognize the private IP address of the secondary network interface or add the corresponding routes. For more information, see Configuring secondary network interfaces for ECS instances.
The security group does not allow the relevant traffic.	The security group associated with the secondary network interface may not allow the outbound and inbound traffic required. Check whether it allows the outbound and inbound traffic required. For more information, see Managing security group rules. If you configure a firewall within the ECS instance, you must also configure traffic ports for the firewall.
The network ACL does not allow traffic.	The network ACL associated with the subnet where the secondary network interface is located may not allow the relevant traffic. Check whether it allows the outbound and inbound traffic you need. For more information, see Network ACL overview and Modifying network ACL rules.

Why does access to the public network fail after I mount a secondary network interface to a Windows ECS instance?

After you mount a secondary network interface to a Windows ECS instance, the image automatically detects the secondary network interface and adds routes. However, the automatically added routes for the secondary network interface are equivalent to those of the primary network interface, which may result in public network-bound data transfer being routed to a network interface that does not have an associated Elastic IP address (EIP). Therefore, you need to manually specify the forwarding policy. For more information, see Modify network interface routes for a Windows instance.

Can I change the EIP and private IP address of a network interface?

For information about how to change the EIP of a network interface, see Associating/Disassociating EIPs.

You can change the secondary private IP addresses of a network interface (including secondary private IPv4 address and private IPv6 address) by releasing or adding private IP addresses. For more information, see Assigning/Reclaiming IPv4 addresses and Assigning/Reclaiming IPv6 addresses.

You cannot change the primary private IPv4 address of a secondary network interface. However, you can change the primary private IPv4 address of the primary network interface by changing the VPC.

Can I unmount the primary network interface?

No, you cannot. The lifecycle of the primary network interface is consistent with that of the ECS instance. You cannot unmount the primary network interface.

What should I do if I fail to unmount a network interface?

Go to the ECS console and click "Support > Create ticket" in the top menu bar to obtain support.

Why is an incorrect IP address displayed on a Windows instance after I mount, uninstall, or disable a network interface and perform other operations?

You can try to restart the instance. If the issue persists, execute ipconfig /release and ipconfig /renew commands within the instance to refresh the IP address.

Security group

How do I plan security groups appropriately?

Proper security group planning simplifies business traffic management and enhances security. For the planning principles and examples, see Planning security groups.

How do I open a port?

You can add rules to the security group associated with the network interface of an ECS instance to allow traffic through the specified port. For more information, see Adding security group rules.

What are the common ports for ECS instances?

For more information, see Common ports for ECS instances.

How do I open port 25?

Port 25 is a high-risk port. VolcanoEngine blocks this port by default. Even if you open port 25 by specifying a security group rule, the port remains unavailable. Therefore, we recommend that you use other non-high risk ports.

When port 25 is required for business purposes, submit a ticket to apply for its use. Only enterprise users are eligible to do so.

What do I do if I fail to access specific ports on the public cloud?

Issue phenomenon: Access to specific ports on the public cloud fails in some regions and with some line operators, while access to other ports is normal.

Issue analysis: Some line operators identify the ports listed in the following table as high-risk and block them by default.

Agreement	Port
TCP	42 135 137 138 139 444 445 593 1025 1068 1434 3127 3128 3129 3130 4444 4789 5554 5800 5900 9996
UDP	135 139 1026 1027 1028 1068 1433 1434 4789 5554 9996

Solution: We recommend that you change sensitive ports to other non-high risk ports for business use.

How to view which ports are opened on an ECS instance?

To view the ports opened on each network interface of an ECS instance, perform the following operations:

In the top menu bar, select a target region.

In the left-side navigation pane, click "Instances".

Click the name of the target ECS instance.

In the upper left corner on the "Security Group" tab, select the target network interface (the primary network interface or a secondary network interface).

Select the "Inbound" or "Outbound" tab based on your needs to view the ports opened in the "Port range" column of the security group rules.

How do I change the security groups for an ECS instance?

To change the security groups for an ECS instance, you are essentially changing the security groups for the network interfaces mounted to the ECS instance. For more information, see Changing security groups.

What are the differences between a security group and the Windows Firewall?

They belong to different entities. A security group is a feature of VPC, and each network interface of an ECS instance must be associated with a security group. The Windows Firewall is part of the Windows operating system.

Traffic path for Windows instances:

Outbound: Traffic first passes through the Windows Firewall, and then through the security group, before accessing other cloud services or the public network.

Inbound: Traffic from other cloud services or the public network first passes through the security group, and then through the Windows Firewall, before accessing applications on the Windows system.

Their usage scenarios are different.

A security group is mainly used to control inbound and outbound traffic for a set of network interfaces. It enables quick setup of traffic control systems between ECS instances, and between ECS instances and the public network.

The Windows Firewall is primarily used to control traffic for applications running on the Windows system.

Why is a Windows instance with an associated EIP still unable to communicate with the public network even after the security group rules are configured to allow traffic?

Possible causes are as follows:

You have enabled the Windows Firewall. You can disable the Windows Firewall or configure rules to allow traffic. For more information, see Configuring firewall of Windows ECS instance.

The subnet to which this instance belongs is associated with a network Access Control List (ACL). You can either disassociate the subnet from the network ACL or configure network ACL rules to allow traffic. For more information, see Managing network ACL rules.

How can I see whether ports enabled in a security group take effect?

After you open a port by configuring the security groups associated with an ECS instance, you can use any of the following methods to verify whether the port of the ECS instance is reachable.

Method 1: telnet command

Method 2: nc command

On a terminal within the CIDR block allowed by the security group, execute the following command in the command line:

telnet <IP address of the ECS instance> <allowed port>

If the port is not allowed, the request will persist until the operation times out.

If the port is allowed but no service is deployed on it, a connection refused message will be returned.

If the port is allowed and a service is deployed on it, a connection success message will be returned.

Why can't I access services deployed on an ECS instance after I configure the security group for the instance?

Possible causes are as follows:

Cause	Description
Network ACL restrictions	If network ACLs are created, check whether the network ACL associated with the subnet of the ECS instance restricts access traffic. Learn more
Firewall restrictions of the operating system	Check whether the firewall of the ECS instance's operating system restricts access traffic. For more information, see Configuring firewall for ECS instance running CentOS 7, Configuring firewall for ECS instance running Windows, and Configuring firewall for ECS instance running Ubuntu.
Abnormal status of the ECS instance	Check whether the status of the ECS instance is abnormal, such as being unstarted, shut down due to arrears, or shut down upon expiration. Learn more
Services not started	Check whether the services deployed on the ECS instances are started.
Public network exceptions	If services are provided to public network terminals, resolve the issue by performing the following checks: If an EIP is associated with the ECS instance to provide services to the public network, check whether the EIP is shut down due to arrears or expiration. Learn more If services are provided to the public network using the DNAT rules of a public network NAT gateway, check whether the DNAT rule configuration is correct. Learn more If services are provided to the public network using CLB, check whether the CLB configuration is correct. Learn more
Cloud Firewall restrictions	If Cloud Firewall is enabled, verify whether it is restricting data transmission. Learn more

EIP

How to view the IP address of an ECS instance?

You can view the EIP associated with an instance on the instance list page or details page. For more information, see View created instances and instance configuration information.

How can I view the price of an EIP instance?

You can view the price of an EIP instance on the price calculator page. The price calculator provides reference prices. The specific fees shall be subject to the actual order results in the EIP console.

How do I view the EIP bandwidth of an instance?

To view the bandwidth upper limit of the EIP associated with an instance, perform the following operations:

Elastic IP addresses with different bandwidth specifications have different minimum bandwidth limits. Please refer to Fee Description for details.

In the left-side navigation pane, select "Instances & Images > Instances".

In the top menu bar, select the region and project.

In the list of instances, click the EIP of the target instance.

View the bandwidth upper limit in the "Current configuration" section of the EIP details page.

How do I modify the configuration of the EIP associated with an ECS instance?

You can modify the configuration of the EIP associated with an ECS instance based on your needs. For more information, see Changing EIP configuration.

How do I change the EIP of an ECS instance?

To change the EIP associated with the primary private IPv4 address of the primary network interface of an ECS instance, you first apply for an EIP, then disassociate the current EIP from the ECS instance, and finally associate the new EIP with the ECS instance.

For information about how to change the EIP associated with either the secondary private IPv4 address of an ECS instance's primary network interface or the ECS instance's secondary network interface, see Associating/Disassociating an EIP.

What changes will occur to the bandwidth when a pay-as-you-go EIP is added to a shared bandwidth package? What is the range of the bandwidth upper limit for a shared bandwidth package?

After an EIP is added to a shared bandwidth package, its original bandwidth upper limit becomes invalid, and it shares the bandwidth upper limit of the shared bandwidth package.

The bandwidth upper limit for a shared bandwidth package ranges from 2 to 5,000 Mbps.

Why does an ECS instance remain unable to connect to the Internet after being associated with an EIP?

An ECS instance is associated with an Elastic IP (EIP) when the EIP is associated with the primary private IPv4 address of the instance’s primary network interface. If the instance fails to access the Internet, the possible causes are described in the following table:

Cause	Description
The security group does not allow the relevant traffic.	The security group associated with the primary network interface may not allow the outbound and inbound traffic required. Check whether it allows the outbound and inbound traffic required. For more information, see Managing security group rules. If you configure a firewall within the ECS instance, you must also configure traffic ports for the firewall.
The network ACL does not allow traffic.	The network ACL associated with the subnet where the primary network interface resides may not allow the relevant traffic. Check whether it allows the inbound and outbound traffic you need. For more information, see Network ACL overview and Modifying network ACL rules.
Abnormal status of the EIP	The EIP status may be abnormal, such as being shut down upon expiration or due to arrears.

Why is the access latency of an ECS instance high?

Possible causes are as follows:

Cause	Description
Access to domain names outside the Chinese mainland	ECS instances in the Chinese mainland may experience high network latency or unstable connection when accessing domain names outside the Chinese mainland.
Bandwidth limit	The latency is related to your network environment, computer performance, and remote connection settings. We recommend that you troubleshoot the issue from the following aspects: Switch to a better-performing network and close other applications or devices that consume large amounts of network resources to reduce network bandwidth usage pressure. Adjust remote connection settings: Higher resolution and color depth increase the amount of data transmitted and latency. We recommend that you lower the display settings of the remote desktop, such as resolution and color depth. Identify if bandwidth rate limiting exists by viewing monitoring data. You can increase the bandwidth upper limit or add to a shared bandwidth package to improve bandwidth utilization.
Shared ECS instance limits	In the non-binding CPU scheduling mode of Shared instances, each vCPU is randomly assigned to any idle CPU hyper-thread. vCPUs from different instances may compete for physical CPU resources, leading to unstable fluctuations in computing performance under high load. We recommend that you use General-purpose g3al instances to resolve this issue.

Last updated: 2026.06.18 17:48:25