Huawei Cloud VPC
STOP - Do not answer from general knowledge. Follow the procedure below.
Always run hcloud <Service> <Operation> --help before constructing commands to discover exact parameter names and requirements.
Multi-version APIs: KooCLI may print a warning like "ListVpcs有多个版本,默认使用该API版本v3" before the actual response. The text BEFORE the first { is the version selection notice — parse JSON starting from { only. This is normal behavior, not an error.
Overview
Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
Critical Warnings
| Trap |
Why |
| VPC CIDR cannot change |
Once set, VPC CIDR block is immutable |
| Security group stateful |
SG rules are stateful. Return traffic auto-allowed |
| Network ACL stateless |
ACL rules must allow both inbound AND outbound |
| EIP bills when idle |
Unbound EIP still charges. Release when unused |
| Subnet AZ binding |
Subnet tied to single AZ. Cross-AZ needs multiple subnets |
EIP PER type needs --bandwidth.name |
PER bandwidth requires explicit name; --help marks it optional but it's required |
| VPC params need nested prefix |
KooCLI 7.x VPC API uses --vpc.<param>, --subnet.<param>, --security_group.<param>. Example: --vpc.name=xxx NOT --name=xxx |
| Security group needs no vpc_id |
VPC v3 API CreateSecurityGroup does NOT accept vpc_id. Security groups are region-level, not VPC-bound |
| Subnet DNS empty → ECS no DNS |
DNS params (--subnet.primary_dns, --subnet.secondary_dns) marked optional but empty default breaks cloud-init domain resolution — yum/apt installs fail silently. Always set both. Common DNS (primary / secondary): cn-north-4 (100.125.1.250 / 100.125.129.250), cn-north-1 (100.125.1.250 / 100.125.21.250), cn-east-3 (100.125.1.250 / 100.125.64.250), cn-south-1 (100.125.1.250 / 100.125.136.29), ap-southeast-3 (100.125.1.250 / 100.125.128.250). Authoritative per region: hcloud DNS ListNameServers --type=private --region=<r> |
| SCP blocks 0.0.0.0/0 SG rules |
If CreateSecurityGroupRule with --remote_ip_prefix=0.0.0.0/0 fails with SYS.0403, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
VPC tags use * separator |
VPC tag format: --vpc.tags.1=env*test (asterisk between key and value). NOT --vpc.tags.1.key=env (ECS-style). This is different from ECS --server.metadata.key=value |
Common Workflows
| Task |
Command |
Steps |
| Create VPC |
hcloud VPC CreateVpc --vpc.name= --vpc.cidr= |
CIDR must not conflict with existing VPCs. Run hcloud VPC ListVpcs first |
| Create subnet |
hcloud VPC CreateSubnet --subnet.name= --subnet.vpc_id= --subnet.cidr= --subnet.gateway_ip= --subnet.primary_dns= --subnet.secondary_dns= --subnet.availability_zone= |
Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
| Update subnet |
hcloud VPC UpdateSubnet --subnet_id= --subnet.dnsList.1= --subnet.dnsList.2= |
Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
| Security group |
hcloud VPC CreateSecurityGroup --security_group.name= |
references/security-group.md |
| SG rule |
hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id= --security_group_rule.direction= --security_group_rule.protocol= --security_group_rule.multiport= --security_group_rule.remote_ip_prefix= |
references/security-group.md |
| Create EIP |
hcloud EIP CreatePublicip --publicip.type= --bandwidth.size= --bandwidth.share_type= --bandwidth.name= |
Run hcloud EIP CreatePublicip --help to confirm valid type values per region |
| Bind EIP to ECS |
hcloud EIP AssociatePublicips --publicip_id= --publicip.associate_instance_id= --publicip.associate_instance_type=PORT |
Get port ID from hcloud ECS ListServersDetails --server_id=<id> → OS-EXT-IPS:port_id |
| Unbind EIP |
hcloud EIP DisassociatePublicips --publicip_id= |
references/network.md |
| Delete EIP |
hcloud EIP DeletePublicip --publicip_id= |
references/network.md |
| List EIPs |
hcloud EIP ListPublicips |
|
| NAT gateway |
hcloud NAT CreateNatGateway --nat.name= --nat.spec= --router_id= --internal_network_id= |
Run hcloud NAT CreateNatGateway --help for available spec values |
Troubleshooting
| Error |
Root Cause -> Fix |
| Cannot reach instance |
SG missing rule or no EIP -> Add SG rule / Bind EIP |
| Subnet CIDR conflict |
Overlapping with existing subnets -> Choose non-overlapping CIDR |
| NAT gateway no internet |
Route table missing default route -> Add 0.0.0.0/0 via NAT |
| EIP quota exceeded |
Check actual quota: hcloud EIP ListPublicips --cli-region=<r> to see current usage. Default varies by account (typically 5-10) |
| EIP.7905 |
Run hcloud EIP ListPublicips --cli-region=<r> first to check current usage |
| VPC.0301: Bandwidth name invalid |
PER type requires --bandwidth.name, even though --help marks it optional |
| EIP has no public IP after binding |
May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
| ECS cloud-init fails silently (port 80/443 closed) |
Subnet likely has no DNS. Check hcloud VPC ShowSubnet --subnet_id=<id> → dnsList empty? Rebuild subnet with --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>. DNS addresses per region: hcloud DNS ListNameServers --type=private --region=<r> |
| VPC.0209: Subnet still used |
Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
| SYS.0403 / SCP deny |
Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see huawei-ecs — no SSH needed |
Security Considerations
- MUST use security groups, NOT iptables
- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
- SHOULD use network ACLs as defense-in-depth
- SHOULD place databases in private subnets (no EIP)
- MUST enable VPC flow logs for audit
MCP Tools
- huaweicloud_list_operations service=VPC
- huaweicloud_run_readonly_command for VPC/subnet discovery
- huaweicloud_run_approved_command for writes
References
1---2name: huawei-vpc3description: Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration.4---56# Huawei Cloud VPC78**STOP - Do not answer from general knowledge.** Follow the procedure below.910Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.1112> **Multi-version APIs**: KooCLI may print a warning like "ListVpcs有多个版本,默认使用该API版本v3" before the actual response. The text BEFORE the first `{` is the version selection notice — parse JSON starting from `{` only. This is normal behavior, not an error.1314## Overview1516Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.1718## Critical Warnings1920| Trap | Why |21| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |22| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |23| Security group stateful | SG rules are stateful. Return traffic auto-allowed |24| Network ACL stateless | ACL rules must allow both inbound AND outbound |25| EIP bills when idle | Unbound EIP still charges. Release when unused |26| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |27| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |28| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |29| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |30| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS (primary / secondary): cn-north-4 (100.125.1.250 / 100.125.129.250), cn-north-1 (100.125.1.250 / 100.125.21.250), cn-east-3 (100.125.1.250 / 100.125.64.250), cn-south-1 (100.125.1.250 / 100.125.136.29), ap-southeast-3 (100.125.1.250 / 100.125.128.250). Authoritative per region: `hcloud DNS ListNameServers --type=private --region=<r>` |31| SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |32| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |3334## Common Workflows3536| Task | Command | Steps |37| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |38| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |39| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |40| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |41| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |42| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |43| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |44| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |45| Unbind EIP | hcloud EIP DisassociatePublicips --publicip_id=<id> | references/network.md |46| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/network.md |47| List EIPs | hcloud EIP ListPublicips | |48| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |4950## Troubleshooting5152| Error | Root Cause -> Fix |53| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |54| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |55| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |56| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |57| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |58| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |59| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |60| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |61| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud DNS ListNameServers --type=private --region=<r>` |62| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |63| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |6465## Security Considerations6667- MUST use security groups, NOT iptables68- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/069- SHOULD use network ACLs as defense-in-depth70- SHOULD place databases in private subnets (no EIP)71- MUST enable VPC flow logs for audit7273## MCP Tools7475- huaweicloud_list_operations service=VPC76- huaweicloud_run_readonly_command for VPC/subnet discovery77- huaweicloud_run_approved_command for writes7879## References8081- VPC Docs: https://support.huaweicloud.com/vpc/82- Subnet guide: references/subnet.md83- Security group: references/security-group.md
huaweicloud