Alibaba Cloud VPC, vSwitch, NAT and security groups on STACKIT

A public vSwitch, a NAT gateway and a security group, assessed

Input on the left, an excerpt of assessment.json on the right with the values the run wrote on 4 November 2026. The security group carries two rules: HTTPS allowed from anywhere and Telnet dropped, both at priority 1. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged. The input blocks are shown in separate panes because they are not next to each other in main.tf.

resource "alicloud_vswitch" "public" {
  vswitch_name = "payments-public"
  vpc_id       = alicloud_vpc.main.id
  cidr_block   = "10.80.0.0/24"
  zone_id      = "eu-central-1a"
}

resource "alicloud_nat_gateway" "egress" {
  vpc_id           = alicloud_vpc.main.id
  vswitch_id       = alicloud_vswitch.public.id
  nat_gateway_name = "payments-egress"
  nat_type         = "Enhanced"
  payment_type     = "PayAsYouGo"
}

resource "alicloud_security_group" "web" {
  security_group_name = "payments-web"
  vpc_id              = alicloud_vpc.main.id
}

resource "alicloud_security_group_rule" "web_https" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "443/443"
  priority          = 1
  security_group_id = alicloud_security_group.web.id
  cidr_ip           = "0.0.0.0/0"
}

resource "alicloud_security_group_rule" "web_deny_telnet" {
  type              = "ingress"
  ip_protocol       = "tcp"
  policy            = "drop"
  port_range        = "23/23"
  priority          = 1
  security_group_id = alicloud_security_group.web.id
  cidr_ip           = "0.0.0.0/0"
}

[
  {
    "id": "alicloud_vswitch.public",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT network"
      },
      "reason": "A vSwitch becomes a STACKIT network with its own address range. It is bound to a zone at the source; review the zone placement of the workloads on it."
    }
  },
  {
    "id": "alicloud_nat_gateway.egress",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "NAT gateway rules do not carry over one to one. Whether the egress and any published port need a STACKIT network with a public address, or a NAT appliance on a server, is an architect's decision."
    }
  },
  {
    "id": "alicloud_security_group.web",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "LOW",
      "target": {
        "service": "STACKIT security groups"
      },
      "reason": "A security group becomes a STACKIT security group. STACKIT rules only allow traffic, so a deny rule or a priority order of the source needs a decision."
    }
  }
]

• vSwitch: a network with its own range

  MEDIUM confidence. The vSwitch is bound to a zone at the source, so the zone placement of the workloads on it is reviewed.

• NAT gateway: your call

  MANUAL_REVIEW with LOW confidence. Whether egress and any published port need a STACKIT network with a public address or a NAT appliance on a server is an architect decision.

• Security group: LOW on purpose

  The two rules are linked to the group, but StackToIT recognises the rule resource type without mapping it. The run says so and caps the group at LOW instead of guessing what the rules do.

The ten units and where they land

The three security group rules are not units of their own: the run attaches them to their group as facets. The database group lands in wave 3 because its rule names the web group as the source.

Security groups: what changes in the rules

Alibaba Cloud and STACKIT documentation side by side, applied to the two rule types in the estate.

• Deny and priority

  Alibaba Cloud rules carry a priority from 1 to 100 and an Allow or Deny policy. At equal priority, Deny rules are placed before Allow rules and the first match decides. STACKIT security groups only allow traffic and are evaluated together, not in order.

• The Telnet drop rule

  On STACKIT, incoming traffic is blocked unless a rule allows it, with one documented exception: traffic between instances in the same security group is allowed. The drop rule for port 23 has no STACKIT equivalent. From outside it is not needed as long as no allow rule you carry across opens that port; between members of the same group, Telnet would be reachable, so harden the servers themselves or split the group.

• Group as the source

  The database rule names the web group as its source, which Alibaba Cloud matches on the private addresses of the group's members. The STACKIT Terraform provider offers a remote_security_group_id argument on security group rules for this; the STACKIT concept page itself only describes address and CIDR sources, so test the rebuilt rule before you rely on it.

• Defaults differ by group type

  Alibaba Cloud basic groups allow inbound traffic from members of the same group and all outbound traffic, while enterprise groups deny both. STACKIT allows all egress through a default rule and blocks incoming traffic except from members of the same group.

• Attachment

  STACKIT groups attach to network interfaces, not to servers. A group can serve many interfaces and several groups on one interface are combined permissively.

• Port ranges and priorities

  The input writes ports as ranges such as 443/443 and gives every rule priority 1. List each rule with its intent before you rebuild it, so the intent survives the loss of the priority number.

NAT, public addresses and egress

Why the NAT gateway is not translated rule by rule.

1. 01

   Alibaba Cloud side

   An Internet NAT gateway lets several ECS instances in a VPC share one EIP for internet access through SNAT entries. A VPC NAT gateway translates private addresses, for example for overlapping ranges.

2. 02

   STACKIT outbound

   Every STACKIT virtual network has a gateway to the internet through source NAT with masquerading. Without a floating IP, a server can connect outward but cannot receive inbound connections.

3. 03

   STACKIT inbound

   Reachability comes from a public IP on a network interface or on a resource such as a load balancer. A floating IP creates a 1:1 NAT mapping between public and private address.

4. 04

   What that means for the estate

   Pure SNAT egress is largely covered by the network itself. Published ports, that is inbound port forwarding through the NAT gateway, become public IPs or load balancers, or a NAT appliance on a server. The run leaves that choice to you.

5. 05

   Allow lists change

   The elastic IP in the estate becomes a STACKIT public IP with a different address. Partners who allow-list your egress address need the new one before cutover.

Order of work the run derives

Wave 1

VPC and EIP: the address plan and the public address exist first.

Wave 2

The three vSwitches (public, app A, app B) and the web security group.

Wave 3

Server, internal load balancer, database security group and the NAT decision.

Packages

Five manual work packages, all owned by the Network Architect except the server, which goes to the Platform Architect.

Questions network teams ask

Sources

• Alibaba Cloud: security group rules
• Alibaba Cloud: what is a NAT gateway
• STACKIT Security Groups: concepts
• STACKIT Virtual Network: concepts
• STACKIT core networking: architecture
• STACKIT Terraform provider: stackit_security_group_rule