Docs

Virtual Private Cloud

Overview

What is Virtual Private Cloud

Introduction

A Virtual Private Cloud (VPC) provides an isolated, self-configured virtual network environment for cloud resources. Within your VPC, you can customize network features including IP address ranges, security groups, and routing policies, enabling simple, efficient, and secure management of cloud resources.

Product architecture

Feature			Explanation
Important components of VPC	VPC CIDR block	The VPC CIDR block defines the IP addresses that can be used by resources within the VPC. The optional IPv4 CIDR blocks (32-bit) are as follows: 10.0.0.0/8~28 (maximum of 16,777,213 IPs for VPC, excluding system reserved) 172.16.0.0/12~28 (maximum of 1,048,573 IPs for VPC, excluding system reserved) 192.168.0.0/16~28 (maximum of 65,533 IPs for VPC, excluding system reserved) 172.31.0.0/16 (Dedicated for default VPC use, excluding those reserved by the system, the number of IPs for the VPC is 65,533) IPv6 CIDR blocks (128-bit) are as follows: The IPv6 address of VolcanoEngine is globally unique. The system automatically assigns an IPv6 CIDR block to you. The subnet mask is fixed at /64. Explanation Dual-Stack VPC is currently in beta stage, available exclusively for completing Enterprise certification accounts for trial use. If you need a trial, please contact the account manager.
		Subnet	A subnet is a segment of a VPC CIDR block allocated within a specific Availability Zone, providing private IP addresses for cloud resources (e.g., ECS instances and Cassic Load Balancers.).
		Subnet route table	A subnet route table consists of a series of route entries that specify the next-hop cloud resource for traffic within the VPC. Each subnet must be associated with one and only one subnet route table, enabling resources within the subnet to forward traffic according to the route table. A single subnet route table can be associated with multiple subnets, and resources within these subnets forward traffic through the associated subnet route table.
		Network interface	A network interface is also called a virtual network interface (vENI). In the Virtual Private Cloud (VPC), a network interface is a network interface mounted on cloud resources like Elastic Compute Service (ECS) or Classic Load Balancer. It serves as an essential component for enabling network communication.
VPC Security	Security group	Security groups control inbound and outbound traffic for ECSs' network interfaces, operating on an allowlist basis. Users can add security group rules according to their requirements to allow specific traffic through the network interface. For example, when an ECS instance provides services externally through port 80, its associated security group must include an inbound rule allowing traffic on port 80. This ensures external clients can properly access the services on that ECS.
VPC Security		Network ACL	Network ACLs (Access Control Lists) control inbound and outbound traffic at the subnet level. Each subnet can be associated with only one Network ACL. As Network ACLs operate on an allow-list principle, traffic must be explicitly permitted to flow through.
VPC operations	Flow Log	After the flow log aggregates and processes the log data of outbound and inbound traffic for network interfaces as needed, it delivers the data to the TLS for storage and search analysis. You can analyze flow logs to monitor network traffic, troubleshoot network issues, and optimize network architecture.
VPC operations		Traffic Mirror	Through traffic mirroring, you can replicate the traffic of a network interface based on custom Mirror Filters and privately forward the replicated traffic to a target service for monitoring and analysis.
Internet Access			To meet the internet needs of resources in a Virtual Private Cloud (VPC), you can combine the following products as needed: EIP: Associating an EIP to a single ECS enables two-way communication with the IPv4 internet. NAT gateway: Multiple ECS instances can share a single EIP for internet access. CLB: Internet traffic can be distributed to multiple backend servers through the CLB. IPv6 gateway: By enabling Internet IPv6 bandwidth for an ECS's IPv6 address, it can communicate with the IPv6 internet.
Access other VPCs			To meet the demand for private network communication between different VPCs, you can select the following products as needed: CEN: Enables full-mesh connectivity between multiple VPCs. TR: Provides on-demand connectivity between multiple VPCs. PrivateLink: Allows a single VPC to expose services to multiple VPCs.
Access data center (IDC)			To meet the needs of building a hybrid cloud, you can select the following products as needed: Direct Connect: High speed, private network connectivity, lengthy implementation, high fee. VPN connection: Internet encryption, instant use, low fee.
Access and manage resources			Supports console, API, Terraform, Pulumi, and other methods to access and manage resources within the VPC.

Last updated: 2026.10.29 19:42:58