What's a vSwitch vs a subnet?

Same concept, different name. Alibaba Cloud uses 'vSwitch' for what AWS and Azure call a 'subnet', a per-zone CIDR carve-out from the VPC. Each vSwitch is bound to one zone; instances in a vSwitch get IPs from that vSwitch's CIDR. Cross-zone traffic flows over the VPC's internal routing.

Do I always need a NAT gateway?

Only if you have private-IP-only instances that need outbound internet access (package mirrors, external APIs, OS updates). Instances with public IPs don't need a NAT. The NAT gateway has hourly + per-GB cost, for very low-traffic environments, putting instances in a public subnet might actually be cheaper, though the security implications are different.

Alibaba VPC Config Builder

NetworkingAlibaba Cloud

Build VPC configurations with vSwitches, NAT gateways, route tables, and multi-zone subnet layouts.

Last verified: May 2026

Alibaba Cloud Virtual Private Cloud (VPC) Configuration

Build VPC configurations with vSwitches, NAT gateways, route tables, and multi-zone subnet layouts.

Required Fields

vpcNamecidrBlock

{
  "vpcName": "prod-vpc",
  "cidrBlock": "10.0.0.0/16",
  "description": "Production VPC for web and application tiers",
  "vSwitches": [
    {
      "name": "web-vsw-a",
      "zoneId": "cn-hangzhou-a",
      "cidrBlock": "10.0.1.0/24",
      "description": "Web tier subnet in zone A"
    },
    {
      "name": "web-vsw-b",
      "zoneId": "cn-hangzhou-b",
      "cidrBlock": "10.0.2.0/24",
      "description": "Web tier subnet in zone B"
    },
    {
      "name": "app-vsw-a",
      "zoneId": "cn-hangzhou-a",
      "cidrBlock": "10.0.10.0/24",
      "description": "Application tier subnet in zone A"
    },
    {
      "name": "db-vsw-a",
      "zoneId": "cn-hangzhou-a",
      "cidrBlock": "10.0.20.0/24",
      "description": "Database tier subnet in zone A"
    }
  ],
  "natGateway": {
    "name": "prod-nat",
    "spec": "Small",
    "bandwidthPackage": {
      "bandwidth": 100,
      "ipCount": 2
    }
  },
  "routeTables": [
    {
      "name": "prod-custom-rt",
      "routes": [
        {
          "destinationCidrBlock": "0.0.0.0/0",
          "nextHopType": "NatGateway",
          "nextHopId": "ngw-bp1uewa15jqn****"
        }
      ]
    }
  ]
}

Generated Output

Output will appear here...

See It in Action

Your team is setting up a new production region on Alibaba Cloud. You design a /16 VPC with three vSwitches per zone (web, app, db tiers), NAT gateway placement, and route tables that keep internal traffic on the VPC. The builder generates Terraform that applies cleanly; the resulting VPC is documented at apply-time and can be reproduced for staging by changing only the CIDR.

What This Tool Does

Alibaba Cloud VPC is the foundational private network, CIDR, vSwitches (subnets), route tables, NAT gateways, and multi-zone deployments. The Alibaba VPC Config Builder generates complete VPC definitions including vSwitches per zone, route tables, and NAT gateway placement. Output is Terraform-ready and maps to `alicloud_vpc`, `alicloud_vswitch`, and related resources.

Technical Details

The builder collects VPC name, region, CIDR, and a list of vSwitches (each with zone, CIDR, and label). NAT gateway, EIP, and route table configurations are added as needed. The builder validates vSwitch CIDRs are within the VPC CIDR, don't overlap, and fall in private space. Output is `alicloud_vpc`, `alicloud_vswitch`, `alicloud_nat_gateway`, and related Terraform resources with explicit dependencies.

Common Use Cases

1Designing a multi-zone VPC for production with per-zone vSwitches sized for current and future workloads.
2Adding NAT gateway capacity to an existing VPC so private-IP-only instances can reach the internet for package updates.
3Documenting an existing VPC's topology before extending into a new region for DR.
4Validating that a proposed VPC layout doesn't conflict with the company's existing IP allocations on Alibaba or other clouds.

Common Questions

What's a vSwitch vs a subnet?: Same concept, different name. Alibaba Cloud uses 'vSwitch' for what AWS and Azure call a 'subnet', a per-zone CIDR carve-out from the VPC. Each vSwitch is bound to one zone; instances in a vSwitch get IPs from that vSwitch's CIDR. Cross-zone traffic flows over the VPC's internal routing.
Do I always need a NAT gateway?: Only if you have private-IP-only instances that need outbound internet access (package mirrors, external APIs, OS updates). Instances with public IPs don't need a NAT. The NAT gateway has hourly + per-GB cost, for very low-traffic environments, putting instances in a public subnet might actually be cheaper, though the security implications are different.

Expert Tips

TIP

Pick a VPC CIDR large enough to grow into, /16 is common and gives 65K addresses across zones. Going smaller means subnet starvation within a year for any growing environment.

TIP

Avoid 10.0.0.0/8 if you have any AWS, Azure, or on-premise presence that uses 10.0.0.0/8. Conflicts at the network layer cause routing problems during multi-cloud peering. 172.16.0.0/12 is a less-contended space.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.

Alibaba VPC Config Builder

NetworkingAlibaba Cloud

Build VPC configurations with vSwitches, NAT gateways, route tables, and multi-zone subnet layouts.

Last verified: May 2026

Alibaba Cloud Virtual Private Cloud (VPC) Configuration

Build VPC configurations with vSwitches, NAT gateways, route tables, and multi-zone subnet layouts.

Required Fields

vpcNamecidrBlock

Generated Output

Output will appear here...

See It in Action

What This Tool Does

Technical Details

Common Use Cases

1Designing a multi-zone VPC for production with per-zone vSwitches sized for current and future workloads.
2Adding NAT gateway capacity to an existing VPC so private-IP-only instances can reach the internet for package updates.
3Documenting an existing VPC's topology before extending into a new region for DR.
4Validating that a proposed VPC layout doesn't conflict with the company's existing IP allocations on Alibaba or other clouds.

Common Questions

What's a vSwitch vs a subnet?: Same concept, different name. Alibaba Cloud uses 'vSwitch' for what AWS and Azure call a 'subnet', a per-zone CIDR carve-out from the VPC. Each vSwitch is bound to one zone; instances in a vSwitch get IPs from that vSwitch's CIDR. Cross-zone traffic flows over the VPC's internal routing.
Do I always need a NAT gateway?: Only if you have private-IP-only instances that need outbound internet access (package mirrors, external APIs, OS updates). Instances with public IPs don't need a NAT. The NAT gateway has hourly + per-GB cost, for very low-traffic environments, putting instances in a public subnet might actually be cheaper, though the security implications are different.

Expert Tips

TIP

Pick a VPC CIDR large enough to grow into, /16 is common and gives 65K addresses across zones. Going smaller means subnet starvation within a year for any growing environment.

TIP

Was this tool helpful?