If your server cannot access the Internet through a NAT gateway, you may have configured the VPC route table incorrectly. Perform the following steps to reset the route table:
-
- Locate the route table associated with the subnet in the VPC.
- Check whether the route table contains the route to the NAT gateway. If not, add the route.
- Ensure that the destination address of the route to be added contain the target address.
-
The NAT gateway provides the SNAT and DNAT functions, allowing multiple ECSs to share one EIP.
-
The ECS that has an EIP bound is exclusively using the IP address.
-
If both SNAT and EIP are configured for an ECS, data will be preferentially forwarded through the EIP.
-
If both DNAT and EIP are configured for an ECS, the ECS will have two EIPs, one that is directly bound to the ECS and one that is associated with the DNAT rule. Incoming data will be forwarded by one of the two EIPs, which is determined by the client user. Outgoing data will be forwarded by the EIP directly bound to the ECS in priority. If the two EIPs are different, data forwarding will fail.
-
Therefore, you are not advised to use a NAT gateway and bind an EIP to the same ECS at the same time.
+
What Are the Differences Between Using a Public NAT Gateway and Using an EIP for an ECS?
+
Public NAT gateways support both SNAT and DNAT and allow multiple ECSs to share EIPs.
+
An EIP bound to an ECS cannot be used by any other ECSs.
+
If both SNAT and EIP are configured for an ECS, the EIP is preferentially used for data forwarding.
+
If both DNAT and EIP are configured for an ECS, inbound traffic will be forwarded by the EIP configured for the DNAT rule or the EIP directly bound to the ECS, which is determined by the client user. The outbound traffic will be forwarded by the EIP bound to the ECS preferentially. If the EIPs used for forwarding inbound and outbound traffic are different, the traffic will fail to be forwarded.
+
Associating an ECS with both an EIP and a public NAT gateway is not recommended.
diff --git a/docs/natgw/umn/nat_faq_0015.html b/docs/natgw/umn/nat_faq_0015.html
deleted file mode 100644
index c9d08f964..000000000
--- a/docs/natgw/umn/nat_faq_0015.html
+++ /dev/null
@@ -1,13 +0,0 @@
-
-
-
What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
-
When creating a NAT gateway, you must specify the VPC and subnet CIDR block for the NAT gateway. This CIDR block can only be used by the system.
-
When you are creating an SNAT rule with Scenario set to VPC, configure a subnet CIDR block for the VPC so that servers in the subnet can access the Internet through the SNAT rule.
-
When you are creating an SNAT rule with Scenario set to Direct Connect, configure the CIDR block of a local data center or another VPC so that ECSs in the CIDR block can access the Internet through the SNAT rule.
-
-
-
diff --git a/docs/natgw/umn/nat_faq_0016.html b/docs/natgw/umn/nat_faq_0016.html
deleted file mode 100644
index 0966cde31..000000000
--- a/docs/natgw/umn/nat_faq_0016.html
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
-
If packet loss or connection failures occur on a server that uses the NAT gateway to access the Internet, you can check the SNAT connections on the Cloud Eye console. If the number of SNAT connections exceeds what the NAT gateway specifications support, there will be packet loss or connection failures. If the number of connections exceeds the upper limit, change the NAT gateway specifications.
-
-
-
diff --git a/docs/natgw/umn/nat_faq_0017.html b/docs/natgw/umn/nat_faq_0017.html
deleted file mode 100644
index bad696f88..000000000
--- a/docs/natgw/umn/nat_faq_0017.html
+++ /dev/null
@@ -1,35 +0,0 @@
-
-
-
What Should I Do If the Remote Server Fails to Be Accessed Through the NAT Gateway?
-
If your TCP connection fails when your ECS is accessing a server on the public network through an SNAT rule, perform the following steps:
-
- Run the following command to check whether tcp_tw_recycle is enabled on the remote server:
sysctl -a|grep tcp_tw_recycle
-If the value of tcp_tw_recycle is 1, tcp_tw_recycle is enabled.
- - Run the following command to check the number of lost packets of the remote server:
cat /proc/net/netstat | awk '/TcpExt/ { print $21,$22 }'
-If the value of ListenDrops is not 0, packet loss occurs, that is, the network is faulty.
-
-
Troubleshooting
Method 1: Modifying the kernel parameter of the remote server
-
-
- Perform the following operations to permanently modify the parameters:
- Modify the /etc/sysctl.conf file:
vi /etc/sysctl.conf
-Add the following content to the file:
-net.ipv4.tcp_tw_recycle=0
- - Press Esc, enter :wq!, and save the file and exit.
- Run the following command to make the modification take effect:
sysctl -p
-
-
-
-
Method 2: Modifying the kernel parameter of the local client
-
-
- Perform the following operations to permanently modify the parameters:
- Modify the /etc/sysctl.conf file:
vi /etc/sysctl.conf
-Add the following content to the file:
-net.ipv4.tcp_timestamps=0
- - Press Esc, enter :wq!, and save the file and exit.
- Run the following command to make the modification take effect:
sysctl -p
-
-
-
-
-
diff --git a/docs/natgw/umn/nat_faq_0018.html b/docs/natgw/umn/nat_faq_0018.html
deleted file mode 100644
index a3e525ca6..000000000
--- a/docs/natgw/umn/nat_faq_0018.html
+++ /dev/null
@@ -1,12 +0,0 @@
-
-
-
Can I Change the VPC for a NAT Gateway After It Is Created?
-
No.
-
You can select a VPC when creating a NAT gateway and cannot change the VPC for the NAT gateway after it is created.
-
-
-
diff --git a/docs/natgw/umn/nat_faq_0020.html b/docs/natgw/umn/nat_faq_0020.html
deleted file mode 100644
index 6a5c2dad2..000000000
--- a/docs/natgw/umn/nat_faq_0020.html
+++ /dev/null
@@ -1,15 +0,0 @@
-
-
-
What Security Policies Can I Configure to Implement Access Control If I Use the NAT Gateway Service?
-
You can configure security groups and firewalls to implement access control.
-
- A security group is a collection of access control rules for ECSs that have the same security protection requirements and are mutually trusted. After a security group is created, you can create various access rules for the security group, and these rules will apply to all ECSs added to this security group.
- A firewall is an optional layer of security for your subnets. You can associate one or more subnets with a firewall to control traffic in and out of the subnets.
-
Security groups operate at the ECS level, whereas firewalls operate at the subnet level. You can use firewalls together with security groups to implement access control that is both comprehensive and fine-grained.
-
For details about security groups and firewalls, see Security in the Virtual Private Cloud User Guide.
-
-
-
-
diff --git a/docs/natgw/umn/nat_faq_0021.html b/docs/natgw/umn/nat_faq_0021.html
index 0327f8d1d..6a090b389 100644
--- a/docs/natgw/umn/nat_faq_0021.html
+++ b/docs/natgw/umn/nat_faq_0021.html
@@ -1,277 +1,277 @@
What Can I Do If Connection Between My Servers and the Internet Fails After I Add SNAT and DNAT Rules?
-
Symptom
You have bought a public NAT gateway and added SNAT and DNAT rules, but your servers cannot access the Internet or provide services accessible from the Internet. Whether the network configured with a public NAT gateway can connect to the Internet depends on the route table configuration, security group configuration, and firewall configuration. If any configuration problem occurs, the network connection will fail. This section describes the fault locating process after a public NAT gateway is configured.
+
Symptom
You have created a NAT gateway and added SNAT and DNAT rules, but your servers cannot access the Internet or provide services accessible from the Internet. Whether the network configured with a public NAT Gateway can connect to the Internet depends on the configurations of route tables, security groups, and firewalls. If any configuration problem occurs, the network connection will fail. This section describes how to troubleshoot network disconnection after a public NAT gateway is created.
-
Fault Locating
The following fault causes are listed in descending order of occurrence probability.
-
If the fault persists after one possible cause is ruled out, move down the list to the other possible causes.
+
Fault Locating
The following fault causes are listed in descending order of occurrence probability.
+
If the fault persists after one possible cause is ruled out, move down the list to the other possible causes.
-
Table 1 Network disconnection troubleshootingPossible Cause
+Table 1 Network disconnection troubleshootingPossible Cause
|
-Solution
+ | Solution
|
|---|
-The route table is incorrectly configured.
+ | The route table is incorrectly configured.
|
-Add the default route or a route pointing to the public NAT gateway to the route table. For details, see Checking Whether Default Route Pointing to the Public NAT Gateway Is Configured in the Route Table.
+ | Add the default route or a route pointing to the public NAT gateway to the route table. For details, see Checking Whether Default Route Pointing to the Public NAT Gateway Is Configured in the Route Table.
|
-The ECS has an EIP bound.
+ | The ECS has an EIP bound.
|
-Unbind the EIP from the ECS. For details, see Checking Whether the ECS Has an EIP Bound.
+ | Unbind the EIP from the ECS. For details, see Checking Whether the ECS Has an EIP Bound.
|
-The security group rules are incorrectly configured.
+ | The security group rules are incorrectly configured.
|
-Configure ECS security group rules to allow traffic to and from the ECS. For details, see Checking Whether Security Group Rules Allow Traffic to and from the ECS Port.
+ | Configure ECS security group rules to allow traffic to and from the ECS. For details, see Checking Whether Security Group Rules Allow Traffic to and from the ECS Port.
|
-The firewall is incorrectly configured.
+ | The Firewall is incorrectly configured.
|
-Add firewall rules to allow traffic in and out of the subnet. For details, see Checking Whether Firewall Rules Allow Traffic in and out of the Subnet.
+ | Add Firewall rules to allow traffic in and out of the subnet. For details, see Checking Whether Firewall Rules Allow Traffic in and out of the Subnet.
|
-The EIP bandwidth exceeds the threshold.
+ | The EIP bandwidth exceeds the threshold.
|
-Increase the EIP bandwidth by referring to Checking Whether the EIP Bandwidth Limit Has Been Exceeded.
+ | Increase the EIP bandwidth by referring to Checking Whether the EIP Bandwidth Limit Has Been Exceeded.
|
-The service volume of the Public NAT gateway exceeds the upper limit.
+ | The SNAT connection limit for the public NAT gateway has been exceeded.
|
-Increase the public NAT gateway specifications. For details, see Checking Whether the SNAT Connection Limit for the Public NAT Gateway Has Been Exceeded.
+ | Increase the public NAT gateway specifications. For details, see Checking Whether the SNAT Connection Limit for the Public NAT Gateway Has Been Exceeded.
|
-The assign status is abnormal.
+ | The public NAT gateway status is abnormal.
|
-Ensure that the public NAT gateway is running. For details, see Check Whether the Public NAT Gateway Status is Normal.
+ | Ensure that the public NAT gateway is running. For details, see Check Whether the Public NAT Gateway Status is Normal.
|
-The ECS port is not listened on.
+ | The ECS port is not listened on.
|
-Enable the ECS port again. For details, see Checking ECS Ports.
+ | Enable the ECS port again. For details, see Checking ECS Ports.
|
Checking Whether Default Route Pointing to the Public NAT Gateway Is Configured in the Route Table- Log in to the management console.
- Click
 in the upper left corner and select the desired region and project. - Click Service List in the upper left corner. Under Network, select Virtual Private Cloud.
- In the navigation pane on the left, choose Route Tables.
- In the route table list, click the name of the route table associated with the VPC to which the public NAT gateway belongs.
- Check whether default route (0.0.0.0/0) pointing to the public NAT gateway is in the route list.
- If no, add the default route pointing to the public NAT gateway to the route table.
- Click Add Route and configure required parameters.
-
Table 2 Descriptions of route parametersParameter
+Checking Whether Default Route Pointing to the Public NAT Gateway Is Configured in the Route Table- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click Service List in the upper left corner. Under Network, select Virtual Private Cloud.
- In the navigation pane on the left, choose Route Tables.
- In the route table list, click the name of the route table associated with the VPC to which the public NAT gateway belongs.
- Check whether default route (0.0.0.0/0) pointing to the public NAT gateway is in the route list.
- If no, add the default route pointing to the public NAT gateway to the route table.
- Click Add Route and configure required parameters.
+
Table 2 Descriptions of route parametersParameter
|
-Description
+ | Description
|
|---|
-Destination
+ | Destination
|
-The destination CIDR block
-Set it to 0.0.0.0/0.
+ | The destination CIDR block
+Set it to 0.0.0.0/0.
|
-Next Hop Type
+ | Next Hop Type
|
-Set it to NAT gateway.
+ | Set it to NAT gateway.
|
-Next Hop
+ | Next Hop
|
-Set it to the ID of the public NAT gateway you purchased.
+ | Set it to the ID of the public NAT gateway you purchased.
|
-Description
+ | Description
|
-(Optional) Supplementary information about the route
-Enter up to 255 characters. Angle brackets (< or >) are not allowed.
+ | (Optional) Supplementary information about the route
+Enter up to 255 characters. Angle brackets (<>) are not allowed.
|
- Click OK.
- - If a default route is there but does not point to the public NAT gateway, add a route pointing to the public NAT gateway to the existing route table. Alternatively, create a route table and add a default route pointing to the public NAT gateway to the new route table.
- To add a route pointing to the public NAT gateway to the existing route table, perform the following steps:
- Click Add Route and configure required parameters.
-
Table 3 Descriptions of route parametersParameter
+- Click OK.
+- If a default route is there but does not point to the public NAT gateway, add a route pointing to the public NAT gateway to the existing route table. Alternatively, create a route table and add a default route pointing to the public NAT gateway to the new route table.
- To add a route pointing to the public NAT gateway to the existing route table, perform the following steps:
- Click Add Route and configure required parameters.
+
Table 3 Descriptions of route parametersParameter
|
-Description
+ | Description
|
|---|
-Destination
+ | Destination
|
-The destination CIDR block
+ | The destination CIDR block
|
-Next Hop Type
+ | Next Hop Type
|
-Set it to NAT gateway.
+ | Set it to NAT gateway.
|
-Next Hop
+ | Next Hop
|
-Set it to the ID of the public NAT gateway you purchased.
+ | Set it to the ID of the public NAT gateway you purchased.
|
-Description
+ | Description
|
-(Optional) Supplementary information about the route
-Enter up to 255 characters. Angle brackets (< or >) are not allowed.
+ | (Optional) Supplementary information about the route
+Enter up to 255 characters. Angle brackets (<>) are not allowed.
|
- Click OK.
- - Create a route table and add a default route pointing to the public NAT gateway.
- In the upper right corner of the Route Tables page, click Create Route Table and configure required parameters.
-
Table 4 Descriptions of route table parametersParameter
+- Click OK.
+- Create a route table and add a default route pointing to the public NAT gateway.
- In the upper right corner of the Route Tables page, click Create Route Table and configure required parameters.
+
Table 4 Descriptions of route table parametersParameter
|
-Description
+ | Description
|
-Example Value
+ | Example Value
|
|---|
-Name
+ | Name
|
-(Mandatory) The name of the route table
-Enter up to 64 characters. Only letters, digits, underscores (_), hyphens (-), and periods (.) are allowed. Spaces are not allowed.
+ | (Mandatory) The name of the route table
+Enter up to 64 characters. Only letters, digits, underscores (_), hyphens (-), and periods (.) are allowed. Spaces are not allowed.
|
-rtb-001
+ | rtb-001
|
-VPC
+ | VPC
|
-(Mandatory) The VPC that the route table belongs to
+ | (Mandatory) The VPC that the route table belongs to
|
-vpc-001
+ | vpc-001
|
-Description
+ | Description
|
-(Optional) Supplementary information about the route table
-Enter up to 255 characters. Angle brackets (< or >) are not allowed.
+ | (Optional) Supplementary information about the route table
+Enter up to 255 characters. Angle brackets (<>) are not allowed.
|
-N/A
+ | N/A
|
-Route Settings
+ | Route Settings
|
-Information about routes
-You can click Add Route to add more routes.
-Set Destination to 0.0.0.0/0, Next Hop Type to NAT gateway, and Next Hop to the public NAT gateway you purchased.
+ | Information about routes
+You can click Add Route to add more routes.
+Set Destination to 0.0.0.0/0, Next Hop Type to NAT gateway, and Next Hop to the public NAT gateway you purchased.
|
-N/A
+ | N/A
|
- Click OK.
An Information dialog box is displayed, indicating that you can associate the route table with a subnet now or later.
- - Click Associate Subnet.
The Associated Subnets tab is displayed.
- - Click Associate Subnet and select the subnet to be associated.
- Click OK.
+ - Click OK.
An Information dialog box is displayed, indicating that you can associate the route table with a subnet now or later.
+ - Click Associate Subnet.
The Associated Subnets tab is displayed.
+ - Click Associate Subnet and select the subnet to be associated.
- Click OK.
-Checking Whether the ECS Has an EIP BoundIf both SNAT and EIP are configured for an ECS, the EIP is preferentially used for data forwarding.
- If both DNAT and EIP are configured for an ECS, the ECS will have two EIPs, one that is bound to the ECS and one that is associated with the DNAT rule. Incoming data will be forwarded by one of the two EIPs, which is determined by the client user. Outgoing data will be forwarded by the EIP bound to the ECS in priority. If the two EIPs are different, data forwarding will fail.
- If the ECS has an EIP bound, perform the following steps to unbind the EIP.
- - Log in to the management console.
- Click
 in the upper left corner and select the desired region and project. - Under Computing, click Elastic Cloud Server.
- In the list, locate the ECS. In the IP Address column, check whether the ECS has an EIP bound.
|
|---|
|
|---|
|
|---|
|
|---|
