Deploying an SDLAN Cloud Gateway on Alibaba Cloud (Real Customer Case)

A long time ago someone asked me whether the router system could be deployed on Alibaba Cloud or Tencent Cloud. Back then I didn't pay much attention — I kept wondering what the point of running a router OS in the cloud actually was. This video uses a real customer case to answer both questions: what it's for, and how to do it. The customer's setup: several servers on Alibaba Cloud, each with its own 10 Mbps public link — running OA, ERP, CRM, a database and data files. The servers exchange data with each other, and with branches and travelling staff. The problem: those services were exposed directly to the internet, and the customer had already been hit by ransomware. Upgrading the cloud provider's firewall carried a very high annual cost. They wanted to use SDLAN to improve security and cut cost. The old approach was simple: install a client on every server, then build an SDLAN network linking branches, HQ and field staff. But the server side involves compatibility issues — Linux, Windows, and the customer's own databases — so a client on every box isn't always the right answer. The approach we used instead: deploy the SDLAN cloud gateway on a brand-new Alibaba Cloud ECS. It doesn't need much CPU or RAM. That ECS sits in the same virtual switch as the servers, so they share an internal network. Then SDLAN links the gateway to branches, HQ and travelling staff. Once that's up, everyone reaches the servers by internal IP. The two payoffs: 1. Each server no longer needs a high-speed public link — a low-bandwidth maintenance link is enough, and all unnecessary public ports get closed. 2. The gateway ECS only needs 15 Mbps of public bandwidth, used mainly for the encrypted tunnels between branches and HQ. Traffic between the gateway and the servers stays on the cloud's internal network, which is effectively unmetered — 10 Gbps bidirectional at minimum. Deployment steps: 1. Prepare a local VM running the gateway system (I used VMware ESXi) 2. Export the finished image from ESXi 3. Convert it locally — both Alibaba Cloud and Tencent Cloud provide the tools and tutorials 4. Upload the converted image to Alibaba Cloud OSS 5. Copy the generated link and import it under Custom Images 6. Create the ECS from that image and start it 7. Detail work: Alibaba Cloud defaults eth0 to WAN with DHCP on a single NIC, so use the command line to switch eth0 to LAN, then save 8. Configure policies between the gateway, the servers and the nodes Chapters (estimated for a 5:46 cut — adjust to your final edit): 00:00 The old question: why run a router OS in the cloud? 00:30 The customer topology: multiple servers, separate links 01:00 Why it had to change: exposed ports, ransomware, firewall cost 01:30 The old approach: a client on every server 01:45 The new approach: a dedicated ECS for the cloud gateway 02:40 The payoff: closed ports, 15 Mbps tunnels, 10 Gbps internal 03:40 Step 1: export the image from ESXi 04:10 Step 2: convert and upload to OSS 04:35 Step 3: import the image and create the ECS 04:50 Step 4: switch eth0 from WAN to LAN, then policies 05:25 Final question: what else would you use a cloud gateway for? One question for you: the gateway is now running in the cloud — besides SDLAN, what else would you use it for? Let me know in the comments. #SDLAN #CloudSecurity #AlibabaCloud #Networking #Ransomware