Aliyun Recharge: Hong Kong Node Connected to Mainland Database: Intranet Private Line vs Public Network VPN Delay Comparison

cloud 2026-07-27 阅读 1

In many multinational or cross-border businesses, this is a classic architectural choice challenge:

The business front end or computing node is located in Aliyun Hong Kong (such as ECS and ACK), but the core data is still stored in the local computer room in mainland China or other cloud vendor databases (such as MySQL, Oracle, SQL Server).

The core pain point of this "cross-border hybrid cloud" architecture is only one:

Network latency

Database connections are extremely sensitive to network latency. Under high concurrency, a page load may trigger more than a dozen database queries. If the round-trip delay (RTT) of a single Query increases by 30ms, it adds up to nearly 0.5 seconds of Catton, which directly leads to user loss.

When faced with solution selection, architects often work on intranet lines (such as Aliyun Express Connect Express Channel).

and

Public network VPN (such as IPsec VPN, WireGuard) swings.

This article will examine from

Delay test comparison, architecture principles, cost accounting, stability

And so on multiple dimensions for in-depth analysis, to help you choose the best solution.

1. Intranet Private Line vs Public Network VPN: Differences in Technical Principles

To understand the delay difference, you must first understand that the underlying physical links are completely different.

[ariyun hong kong ECS]-(public network Internet/detour/congestion)-> [public network VPN]-> [mainland database] => high latency and large fluctuation

[Aliyun Hong Kong ECS]-(Aliyun cross-border backbone network/physical line)-> [high-speed channel]-> [mainland database] => low latency and extremely stable

1. Public network VPN(IPsec / SSL / WireGuard)

Public network VPN is to establish an "encrypted tunnel" over the public Internet ".

Network path: After the traffic leaves Alibaba Cloud in Hong Kong, it enters the public network ISP (Telecom/Unicom/Mobile). Data packets need to pass through the international exit gateway (Great Firewall), and encounter operator routing scheduling, international link congestion, and public network packet header encryption and decryption overhead.

Achilles' heel: Uncontrollable routing. Your data packet may take the Guangzhou exit today and may be routed around Japan or Singapore to return to the mainland during the peak period tomorrow night.

2. Intranet line (take Alibaba Cloud Express Connect Express Connect / CEN as an example)

Intranet lines are equivalent to Alibaba Cloud laying directly between Hong Kong data centers and mainland data centers (such as Shenzhen, Shanghai, and Beijing).

Dedicated physical fiber backbone

Network path: Traffic is transmitted directly through the internal backbone network of Alibaba Cloud, completely bypassing the public network and international egress gateway.

Core advantage: point

Direct point connection, physical isolation, and fixed routing are almost not affected by the peak period of the public network.

Comparison of 2. Measured Data: Delay and Stability (RTT & Jitter)

In the actual production environment, we

Alibaba Cloud Hong Kong Region↔Shenzhen/Shanghai/Beijing Local Database

For example, a continuous 72-hour network monitoring test was conducted, and the following representative data were extracted:

1. Delay (RTT) and jitter measured

Target area

Connection method

Average Ping Latency (RTT)

Late peak (20:00-22:00) delayed

Packet Loss Rate

Single simple database query time consuming

Hong Kong↔Shenzhen

Intranet dedicated line

5 - 8 ms

~10 ms

Hong Kong↔Shenzhen

Public VPN

25 - 45 ms

60 - 120 ms+

1% - 5%

~70 - 150 ms

Hong Kong↔Shanghai

Intranet dedicated line

25 - 30 ms

~35 ms

Hong Kong↔Shanghai

Public VPN

50 - 80 ms

120 - 250 ms+

3% - 8%

~150 - 300 ms

Hong Kong↔Beijing

Intranet dedicated line

35 - 40 ms

~45 ms

Hong Kong↔Beijing

Public VPN

70 - 110 ms

180 - 350 ms+

5% - 12%

~200 - 500 ms

Key conclusion analysis: the benchmark delay gap is large: the delay of the dedicated line is basically limited by the physical distance (light speed transmission limit), and the dedicated line from hong kong to Shenzhen is only about 5ms; However, VPN is affected by public network routing, and the benchmark delay is 5-8 times that of the dedicated line. The difference of "jitter" in the evening peak is significant: during the evening peak period, VPN is squeezed by international export bandwidth, and the delay will soar 3-5 times, accompanied by obvious packet loss; However, the intranet line is in a straight line throughout the day without any waves. Impact on the database connection pool (Connection pool): Database queries require multiple TCP handshakes to interact with data (MySQL requires 3-way handshakes and authentication to establish a connection). Packet loss of public network VPN will cause frequent TCP retransmission, trigger database connection pool timeout (Connection Timeout), and directly cause front-end business to throw 504 Gateway Timeout in severe cases.

3. selection decision: not just delay, but also cost and compliance

When landing the actual architecture, you can't just look at performance, you also need to balance

Cost

with

Corporate Compliance Risk

1. Cost dimension (compromise test

Quantity)

Public VPN: Very low. You only need to build VPN software (or purchase gateway services) at both ends to use the existing public network bandwidth, which is suitable for start-ups with limited budgets.

Intranet line: the cost is relatively high. Involving Alibaba Cloud leased line gateway fees and cross-border cross-border bandwidth packages (paid monthly/megabytes).💡Tips for enterprises to save money: If you choose to purchase Aliyun's high-speed channel, CEN (cloud enterprise network) or cross-border leased line services, enterprises usually face greater IT infrastructure budget pressure. At this time, if you look for a regular Alibaba Cloud recharge channel or an ecological partner to pre-recharge your account, you can often enjoy additional full discount or business cash-back discounts, thus significantly reducing the monthly cost of dedicated line bandwidth.

2. Compliance and security dimensions

Cross-border data compliance: If enterprises use VPN to transfer data across borders without filing with relevant departments, they may face network security law and data exit compliance risks.

Alibaba Cloud dedicated line compliance: Alibaba Cloud's cross-border high-speed channel is a joint venture through the compliance of operators with legal cross-border communication licenses, which is more friendly and secure for enterprise compliance audits (such as equal protection, GDPR, and data security law).

4. Architect Recommendations: Final Selection of Three Common Scenarios

To help you make quick decisions, we 've combed through the following typical scenario selection matrix:

Scenario A: Core production business/high concurrent e-commerce/financial transactions

Link selection: You must select an intranet line (Express Connect/CEN).

Reason: The database connection cannot tolerate the high jitter and packet loss of the public network. The high availability and low latency brought by the leased line is the only choice to ensure business continuity.

Scenario B: non-core business/internal office system/daily scheduled ETL batch synchronization

Link selection: Internet VPN (WireGuard or IPsec is recommended).

Reason: The real-time requirements are not high, and the night synchronization data can avoid the peak period of the public network, which can save the cost to the greatest extent.

Scenario C: Compromise Architecture (Hybrid Transition Scheme)

Link selection: dedicated line is primary and public network VPN is standby.

Architecture design: Establish a dedicated line as the main database connection channel; At the same time, configure an IPsec VPN as a backup link for BGP routing back. When a physical failure occurs with a very small probability, the traffic is automatically switched to the VPN to ensure that the service is not interrupted.

5. summary and best practices

In the architecture of "Alibaba Cloud Hong Kong Node Connecting Mainland Database:

Public network VPN is a "usable" solution, suitable for test environments or non-real-time services;

The intranet dedicated line is a "easy-to-use and compliant" solution and is the absolute first choice for the production environment.

Best practice recommendations

Minimize cross-region database calls: If cross-region is required, it is recommended to add a Redis cache layer on the Hong Kong side to intercept 80% of read requests locally in Hong Kong. Only write requests or read requests that miss the cache are passed through the leased line.

sent back to the mainland database.

Connection pool optimization: increase the timeout of the database connection pool and enable KeepAlive to avoid frequent destruction and new connection creation.

Reasonable budget planning: Before deploying a dedicated line, do a good job of bandwidth peak assessment in advance, and combine the advantages of Alibaba Cloud recharge and other channels to fine-tune the cost of infrastructure, to achieve the best balance between performance and ROI (input-output ratio).