Problem Background

Alibaba Cloud’s VPC differs from other OpenStack-based IaaS platforms in that its routing functions only as a multi-subnet router and does not provide outbound internet routing. Therefore, instances within a VPC cannot access the public internet unless they are bound to an Elastic IP (EIP). According to customer support, this can be resolved by adding a route on the virtual router to forward traffic through an instance bound with an EIP, using NAT and iptables rules.

VPC Architecture Diagram

Virtual Router Configuration

Add Route

To allow internal servers to access the public internet via an EIP, configure all routes targeting 0.0.0.0/0 to forward traffic to the ECS instance bound with the public IP. Note that the next-hop ECS instance cannot be searched directly; you must know its name in advance:

Configuration of the Instance Bound with EIP

Add SNAT Rules to iptables

iptables -t nat -I POSTROUTING -s 192.168.2.0/24 -j SNAT --to-source 192.168.2.20

Note: On Ubuntu 14.04, you need to install the iptables-persistent package to save iptables settings. Use service iptables-persistent save to save the configuration. After installation, the service starts automatically with the system and applies the saved configuration.

Enable IP Forwarding

echo "net.ipv4.ip_forward=1" >>  /etc/sysctl.conf && sysctl -p