NAT Gateway:Use a VPC NAT gateway to enable communication between VPCs that have address conflicts

Examples

Step 1: Add secondary CIDR blocks and create vSwitches

Add secondary CIDR blocks and create vSwitches for both VPC_A and VPC_B. The following table provides an example. You can use custom CIDR blocks, but you must make sure that the CIDR blocks do not overlap.

1. Log on to the VPC console . Click the VPC ID. On the Basic Information tab, click the CIDR Block Management tab and click Add Secondary IPv4 CIDR Block.

   

2. In the left-side navigation pane, click vSwitch. On the vSwitch page, click Create vSwitch.

   

Step 2: Connect VPC_A to VPC_B through a transit router

Associate VPC_A and VPC_B with the same transit router so that VPC_A can access VPC_B.

1. Log on to the CEN console and click Create CEN Instance.

2. In the The CEN instance is created dialog box, click Create Connection.

   Note

   For more information about the regions and zones that support Enterprise Edition transit routers, see Supported regions and zones.

   

Step 3: Configure a VPC NAT gateway

Address translation: You can use SNAT and DNAT entries to translate the IP addresses of ECS instances in VPC_A and VPC_B into NAT IP addresses for communication.

1. Log on to the NAT Gateway console . In the left-side navigation pane, click VPC NAT Gateway. On the VPC NAT Gateway page, click Create VPC NAT Gateway.

   Create a VPC NAT gateway named VPC_NATGW_A for VPC_A and a VPC NAT gateway named VPC_NATGW_B for VPC_B.

   

2. On the VPC NAT Gateway page, find VPC_NATGW_A and click SNAT Management in the Actions column.

   Create an SNAT entry for VPC_A. In this example, Specify VPC is used for the SNAT Entry parameter. You can also use another value.

   

3. On the VPC NAT Gateway page, find VPC_NATGW_B and click DNAT Management in the Actions column.

   Create a DNAT entry for the ECS instance ECS_B in VPC_B. In this example, SSH is used to check the connectivity. Make sure that the security group rules of ECS_B allow requests to port 22. For more information, see Add security group rules. You can also create a custom DNAT entry.

   Note

   SSH: a cryptographic network protocol that uses TCP and port 22.

   

Step 4: Configure route tables

1. Create custom route tables and associate the route tables with vSwitches

   1. In the left-side navigation pane, click Route Tables. On the Route Tables page, click Create Route Table.

      Create a custom route table for both VPC_A and VPC_B.

      

   2. On the Route Tables page, find the route table and click Associate Resource>Bind.

      Associate the vSwitch in VPC_A with the custom route table of VPC_A and the vSwitch in VPC_B with that of VPC_B.

      

2. Optional. Optimize the routes in VPC_A and VPC_B.

   The following adjustments do not affect the connectivity. We recommend that you perform the following steps to optimize the routes.

   Note

   Modify the route priorities. For more information, see Route table overview.

   1. Delete the following routes created by the system after the transit router is configured.

      

   2. In the system route table, withdraw the routes whose CIDR blocks do not fall within the CIDR block to which the VPC NAT gateway belongs.

      

3. Configure routes: Configure routes to forward traffic. Configure routes for VPC_A and VPC_B based on the following table.

   VPC	Route table	Destination CIDR block	Next hop
   VPC_A	System route table	10.0.20.0/24	Transit router
   	Custom route table	10.0.20.0/24	VPC_NATGW_A
   VPC_B	System route table	172.16.20.0/24	Transit router
   	Custom route table	172.16.20.0/24	VPC_NATGW_B

   The following figure shows the route added to the system route table of VPC_A.

   

   

Verify the connectivity

Run the following command on ECS_A. Then, log on to ECS_B and view the IP address of the network interface controller (NIC).

ssh root@10.0.20.190
ifconfig

As shown in the preceding figure, ECS_A can access the NAT IP address (10.0.20.190) of VPC_NATGW_B through the NAT IP address (172.16.20.14) of VPC_NATGW_A. This allows remote logon to ECS_B.

References

• For more information about how to add a NAT IP address to a VPC NAT gateway, see Add a NAT IP address.

• For more information about CEN inter-region connections, see Inter-region connections.

• For more information about VPC connections in different regions and accounts, see Use Enterprise Edition transit routers to connect VPCs in different regions and accounts.