Networking: VPC, SLB, DNS, EIP
VPC building blocks
A VPC is an isolated private network with a CIDR block. Inside it, vSwitches carve subnets bound to a single zone. Routing is controlled by route tables; connectivity to other VPCs uses VPC peering or Cloud Enterprise Network (CEN); on-premises connectivity uses VPN Gateway or Express Connect. NAT Gateway gives private instances outbound internet without inbound exposure; EIP provides a static public IP attachable to instances or NAT/SLB.
Load balancing
SLB distributes traffic across backend servers. Key distinctions:
- CLB (classic) - Layer 4 (TCP/UDP) and Layer 7 (HTTP/HTTPS); mature, general purpose.
- ALB (application) - Layer 7, advanced routing, better for modern HTTP workloads.
- NLB (network) - Layer 4, ultra-high performance and low latency.
Health checks remove unhealthy backends. Session persistence, weighting, and cross-zone load balancing are common configuration levers.
DNS
Alibaba Cloud DNS resolves public domains; PrivateZone resolves internal names inside VPCs. TTL controls caching and failover speed.
Traps
- Assuming two VPCs can talk by default - they cannot without peering/CEN, and overlapping CIDRs block peering.
- Confusing NAT Gateway (outbound) with EIP (inbound+outbound static IP).
- Forgetting that SLB health checks must pass before a backend receives traffic; a misconfigured port silently removes instances.
- Assuming PrivateZone is visible outside its associated VPCs.
Rule of thumb
Plan CIDR blocks up front to avoid overlap across VPCs you may later peer. Use NAT for egress-only private subnets, EIP for services needing a fixed public endpoint, and ALB/NLB over CLB for new Layer 7/Layer 4 designs respectively.
Worked example
Private app servers need to download patches but must not be reachable from the internet: place them in a private vSwitch, route 0.0.0.0/0 to a NAT Gateway with an EIP, and expose the public web tier through an SLB in a public vSwitch.