Network Services Design: VPC, ELB, EIP, DNS, Direct Connect and VPN
What to know
A VPC is region-scoped and contains subnets, each bound to one AZ. Plan CIDR blocks early: overlapping ranges block VPC peering, VPN, and Direct Connect later, and re-IP is brutal. Segmentation uses security groups (instance-level, stateful, allow-only, default-deny inbound) and network ACLs (subnet-level, stateless).
Public exposure: an EIP gives an instance a public address, billed by bandwidth or by traffic, optionally shared across instances. A NAT Gateway lets private subnets egress without individual EIPs (SNAT), and supports DNAT port forwarding for inbound. ELB is the front door for applications: dedicated or shared load balancers, L4 (TCP/UDP) or L7 (HTTP/HTTPS) listeners, health checks, session stickiness, weighted backend server groups, and cross-AZ backends so one AZ failure does not take the service down.
Cloud DNS provides public zones and private zones (internal name resolution inside a VPC), with record sets and CNAMEs.
Interconnect: VPN is IPsec over the internet - fast to deploy, cheap, variable latency; use two tunnels/gateways for resilience. Direct Connect is a private, dedicated circuit into a Huawei Cloud access location - predictable latency and bandwidth, but a single circuit is still a single point of failure. VPC peering connects VPCs privately; hub-and-spoke topologies use a central transit construct.
Traps
A NAT Gateway is outbound-first - do not design inbound services around it. A security group is stateful, an ACL is not; return traffic rules differ. ELB still needs a public address (EIP or shared bandwidth) to serve internet clients. Direct Connect does not encrypt by default - pair it with VPN or application TLS if confidentiality matters.
Rule of thumb
Interconnect ladder by cost and quality: internet+VPN < single Direct Connect < dual Direct Connect from separate locations. Choose the cheapest rung that meets the stated latency and availability requirement.