Docs

Elastic Compute Service

VPC

VPC overview

Description

A Virtual Private Cloud (VPC) provides an isolated and self-configurable virtual network environment for cloud resources. You can customize CIDR blocks, security groups, route policies, and other network settings in your VPCs. This helps you manage cloud resources in a simple, efficient, and secure manner.

Product architecture

Feature			Description
Key components of VPC	VPC CIDR block	The VPC CIDR block defines the IP addresses that can be used by resources within the VPC. The optional IPv4 CIDR blocks (32-bit) are as follows: 10.0.0.0/8–24 (Excluding IP addresses reserved for the system, the maximum number of IP addresses available for resources in the VPC is 16,777,213.) 172.16.0.0/12–24 (Excluding IP addresses reserved for the system, the maximum number of IP addresses available for resources in the VPC is 1,048,573.) 192.168.0.0/16-24 (Excluding IP addresses reserved for the system, the maximum number of IP addresses available for resources in the VPC is 65,533.) 172.31.0.0/16 (dedicated for the default VPC. Excluding IP addresses reserved for the system, the maximum number of IP addresses available for resources in the VPC is 65,533.) IPv6 CIDR blocks (128-bit) cannot be selected. The IPv6 address of VolcanoEngine is globally unique. The system automatically assigns you an /56 IPv6 CIDR block. The subnet mask is fixed at /64. tip Dual-Stack VPC is currently in beta. Only accounts that have completed enterprise authentication can apply for a trial. If you need a trial, contact your account manager.
		Subnet	A subnet is a segment of a VPC CIDR block allocated within a specific availability zone, providing private IP addresses for resources such as ECS instances and Classic Load Balancers.
		Route table	A route table consists of a series of route entries that specify the next-hop cloud resource for VPC traffic. Each subnet must, and can only, be associated with one route table. This way, traffic from resources within the subnet is forwarded based on the route table. A single route table can be associated with multiple subnets. Traffic from resources within the subnets is forwarded based on the route table.
		Network interface	A network interface is a virtual network interface. In the VPC, a network interface is a network interface mounted on cloud resources like ECS or Classic Load Balancer. It serves as an essential component for enabling network communication.
VPC security	Security group	Security groups are designed based on the allowlist principle to control the outbound and inbound traffic for network interfaces of ECS instances. You can add security group rules to allow the required traffic for network interfaces based on your business requirements. For example, if an ECS instance provides services externally over port 80, its associated security group must include an inbound rule allowing traffic over port 80. This ensures that external traffic can access the services provided by that ECS instance as expected.
VPC security		Network Access Control List (ACL)	A network ACL is used to control outbound and inbound traffic for a subnet. Only one network ACL can be associated with each subnet. Network ACLs are designed based on the allowlist principle: traffic is permitted only if explicitly allowed by the allowlist.
VPC operations	Flow log	After the flow log aggregates and processes the log data of outbound and inbound traffic for network interfaces as needed, it delivers the data to the Torch Log Service (TLS) for storage and search analysis. You can analyze flow logs to monitor network traffic, troubleshoot network issues, and optimize network architecture.
VPC operations		Traffic mirroring	You can use traffic mirroring to replicate the traffic of a network interface according to the specified conditions, and forward the replicated traffic over a VPC to the target service for monitoring and analysis.
Access the Internet			To meet the Internet access needs of resources in a VPC, you can combine the following products based on your business requirements: Elastic IP (EIP): By associating a single ECS with an EIP, it can communicate with the IPv4 internet. NAT gateway: Multiple ECS instances can share the same EIP to communicate with the internet. Cloud Load Balancer: Internet traffic can be distributed across multiple backend servers associated with a Cloud Load Balancer instance for processing. IPv6 gateway: Enable IPv6 internet bandwidth for an ECS with an IPv6 address to communicate with the IPv6 internet.
Access other VPCs			To meet the demand for communication between VPCs, you can select the following products as needed: Cloud Enterprise Network (CEN): Enables full communication between multiple VPCs. Transit Router (TR): Enables on-demand communication between multiple VPCs. PrivateLink: Allows a single VPC to provide services for multiple VPCs.
Access data center (IDC)			To meet the needs of building a hybrid cloud, you can select the following products as needed: Direct Connect: High speed, private network interconnection, long construction period, high fee. Virtual Private Network (VPN) connection: Internet encryption, instant use, low fee.

Last updated: 2026.06.18 17:49:50