Tencent Cloud Account for Sale How to Bind Multiple IPs to CVM via Elastic Network Interface ENI

Tencent Cloud / 2026-05-14 22:31:45

Introduction: The “Why Is My IP Not Doing Anything?” Problem

If you’ve ever been told, “Just bind another IP,” you probably pictured a simple button labeled More IPs, Less Problems. Unfortunately, reality is more like: you add an IP, you restart something, and then the network behaves like a cat—technically present, emotionally unavailable.

This article explains how to bind multiple IP addresses to a CVM (Cloud Virtual Machine) using Elastic Network Interface (ENI). We’ll focus on the practical approach: create/attach ENIs, assign secondary private IPs, validate that the OS sees them, and make sure traffic actually arrives at the right process. Along the way, we’ll cover the usual suspects: missing routes, firewall rules that are too strict, ARP confusion, and the age-old “but it works on my other instance” mystery.

By the end, you’ll have a repeatable playbook for multi-IP bindings via ENI—without relying on superstition, duct tape, or mystical incantations.

What ENI Actually Means (And Why You Should Care)

An ENI (Elastic Network Interface) is essentially a network adapter that can be attached to your CVM. Think of it as an attachable “network seat” for traffic. A CVM can have one or more ENIs, and each ENI can hold one primary private IP plus one or more secondary private IP addresses (depending on your cloud configuration and limits).

Why does this matter? Because when you bind multiple IPs, you want each IP to be reachable and routable. ENIs give you the cloud-level plumbing so that those IPs exist on the network and can be used by your services.

Here are the core ingredients you’ll keep seeing:

Primary private IP: The main IP assigned to the ENI at creation time (or attached with defaults).
Secondary private IPs: Additional IPs added to the same ENI so multiple addresses can point to the instance.
ENI attachment: Connecting the ENI to your CVM so the instance can receive traffic for those IPs.
OS-level network configuration: Making sure your Linux guest recognizes the extra IPs and routes them appropriately.
Firewall/security group: Allowing traffic to those IPs on the ports you care about.

Prerequisites and Planning (Before You Touch Anything)

Before you start, gather these details. Future You will be grateful.

Your target VPC and subnet (ENIs must live in a subnet).
The CVM’s operating system (most examples below assume Linux).
The IP addresses you want to bind (secondary private IPs within the same subnet range).
The ports/services you plan to expose on each IP (for example, different Nginx vhosts, different internal services, or IP-based routing).
Any existing network configuration (routing tables, iptables/nftables, cloud firewall/security group rules).

Also check your quotas/limits. Multi-IP on ENI isn’t always unlimited—sometimes it’s limited by instance type, subnet capacity, or ENI configuration rules.

High-Level Options: Multiple ENIs vs. Multiple IPs on One ENI

You typically have two designs:

Option A: Multiple IPs on a Single ENI

You attach one ENI and add secondary private IPs to it. This is usually the cleanest: fewer devices, simpler routing, and less complexity in the guest OS.

Option B: Multiple ENIs (Each With Its Own IP)

You attach multiple ENIs to the instance, each with its own primary IP (and maybe secondary IPs). This is useful if you need different network security boundaries or want to treat each network interface more separately.

This article focuses on the common scenario of binding multiple IPs via ENI by adding secondary private IPs. We’ll mention multiple ENIs when it’s helpful, but the core approach stays the same.

Step 1: Create or Identify the ENI

Depending on what you already have, you might already have an ENI attached to the CVM. If not, create one in the correct VPC/subnet.

Conceptually, the process is:

Create an ENI in the same VPC/subnet as the CVM.
Attach the ENI to your CVM.
Assign additional private IPs as secondary IPs to that ENI.

If you already have an ENI attached, you can skip creation and directly add secondary private IPs to the existing ENI (assuming the cloud provider allows it).

Step 2: Assign Secondary Private IPs to the ENI

Once your ENI exists and is attached, you can add additional private IP addresses to it. In many setups, you’ll:

Open the ENI details page.
Find the option to add secondary private IPs.
Select the desired IPs (or let the system assign them) within the subnet.
Save/apply changes.

At this moment, the cloud-level network knows those IPs belong to your instance’s ENI. But your guest OS may not automatically configure them. So don’t panic if you can’t ping yet. We’re just warming up the OS.

Step 3: Validate the Network Interface inside the Guest OS

Now we switch from the cloud control plane to the instance’s Linux networking reality. Let’s identify the interface name that corresponds to your ENI.

Run:

ip link show

Tencent Cloud Account for Sale Look for interfaces like eth0, eth1, or predictable network interface names (often ensX). Then check addresses:

ip addr show

You’ll see the primary IP address already assigned. Secondary IPs might not appear yet.

To confirm what IPs are currently configured:

ip -4 addr

Also check routes:

ip route

You’re looking for sanity: default route, subnet route(s), and the general correctness of your network stack.

Step 4: Add Secondary IPs at the OS Level (Linux Examples)

Depending on the cloud’s integration features, secondary IPs may be automatically configured. Often, you’ll still need to add them at the OS level. The principle is: add the IP address to the correct network interface.

Suppose your ENI interface inside the VM is eth0, and you want to add these secondary private IPs:

10.0.2.101/24
10.0.2.102/24
10.0.2.103/24

You’d run (as examples):

sudo ip addr add 10.0.2.101/24 dev eth0
sudo ip addr add 10.0.2.102/24 dev eth0
sudo ip addr add 10.0.2.103/24 dev eth0

Then confirm they exist:

ip -4 addr show dev eth0

Now test binding readiness by pinging from the same VPC (if possible) or from within your network:

ping -c 3 10.0.2.101

If ping works, the IP exists and the interface responds. If not, we need to troubleshoot (we’ll get to that later, don’t worry).

Important: This IP addition is typically not persistent across reboot unless you configure it in the proper network configuration system. For long-term use, you should persist these addresses. How you do that depends on your Linux distribution.

Step 5: Make It Persistent (So Reboots Don’t Undo Your Progress)

Tencent Cloud Account for Sale Let’s be honest: rebooting after doing network changes is like pressing “new game” after you already beat the boss. Sometimes you just need to do it, and sometimes your changes vanish. So persist the IP addresses.

Here are common persistence approaches:

Debian/Ubuntu (netplan)

Check your netplan config (often in /etc/netplan/), then add secondary addresses under the interface. Example structure:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
        - 10.0.2.101/24
        - 10.0.2.102/24
        - 10.0.2.103/24

Then apply:

sudo netplan apply

Tencent Cloud Account for Sale Note: you must include the correct primary address as well, not just secondaries, otherwise you might accidentally remove your primary IP.

RHEL/CentOS/Amazon Linux (NetworkManager or ifcfg files)

With legacy ifcfg- files, you can add additional IPs in the interface configuration. Exact syntax varies by distro and version.

Alternatively, if you’re using NetworkManager, you can use its CLI to manage multiple addresses. But the easiest approach is: align with your distro’s recommended network configuration mechanism.

If you tell me your OS distribution and version, I can tailor a persistence snippet that actually matches your environment. For now, the key idea is: persist the ip addr add equivalent using your system’s network configuration.

Step 6: Ensure ARP and Local Delivery Behave (Because Networks Love Drama)

When you add additional IP addresses to an interface, the kernel will respond to ARP requests for those IPs. Typically this is automatic. But sometimes you’ll see issues like:

Traffic doesn’t reach the instance even though the IP exists.
Some clients see inconsistent behavior.
Logs show connection attempts but no responses.

Tencent Cloud Account for Sale Common reasons include firewall rules, missing routing, or application binding limitations (your app might only listen on one IP).

For ARP-related sanity checks, you can do:

ip neigh show

Also verify that reverse path filtering (rp_filter) isn’t killing asymmetric flows. On some Linux setups, /proc/sys/net/ipv4/conf/all/rp_filter settings can be strict.

Check:

sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.eth0.rp_filter

If you find rp_filter is set aggressively and you have a reason for asymmetric routing, you may need to adjust it (carefully). Many deployments avoid changing this unless necessary.

Step 7: Configure Services to Listen on the Multiple IPs

Having the IP configured is necessary but not sufficient. Your application still needs to listen on that address.

Here are a few patterns:

Tencent Cloud Account for Sale Listen on all interfaces: if your service binds to 0.0.0.0, it automatically listens on all IPv4 addresses present on the host.
Listen on a specific IP: if your service binds to 10.0.2.101, then it won’t accept connections to 10.0.2.102 unless you configure separate listeners.
Use IP-based virtual hosting: for web servers like Nginx/Apache, you can map Host/IP to different backends.

Check what your service is listening on. For example, if Nginx is running:

sudo ss -lntup | head -n 50

You’re looking for entries like:

LISTEN 0 511 0.0.0.0:80 (great)
or LISTEN 0 511 10.0.2.101:80 (works only for that IP)

Nginx Example (IP-based server blocks)

If you want Nginx to serve different content based on the destination IP, you can define server blocks with different listen directives.

Example conceptually:

server {
  listen 10.0.2.101:80;
  server_name _;
  # content for 10.0.2.101
}

server {
  listen 10.0.2.102:80;
  server_name _;
  # content for 10.0.2.102
}

Alternatively, you can listen on a port and use server_name with DNS. But since this guide is about binding multiple IPs, IP-based listening is a very direct approach.

Step 8: Update Firewall Rules and Security Groups

Even if the OS has the IP and the service listens correctly, traffic can still get blocked. Clouds often have at least two layers of filtering:

Cloud security group / firewall rules (in the control plane)
Host firewall (iptables/nftables/UFW)

Make sure inbound rules permit traffic to the relevant ports. Some setups allow “allow to the instance” without IP-level distinction. But others require specifying source CIDRs and ports.

On the host, check firewall status. For example, on systems with UFW:

sudo ufw status verbose

For nftables, list rules:

sudo nft list ruleset | head -n 50

For iptables (older setups):

sudo iptables -S

If you’re using both cloud and host firewalls, remember: the most restrictive rule wins. The network is not a negotiator; it’s a bouncer.

Step 9: Verify End-to-End Connectivity

Once the IPs are configured and services are listening, verify connectivity in layers.

1) Local verification (from the instance)

ping -c 3 10.0.2.101
ip route get 10.0.2.101

The route get command helps confirm the kernel’s decision.

2) Remote verification (from another host)

From a different instance in the same subnet or VPC:

ping -c 3 10.0.2.101
curl -v http://10.0.2.101:80

For TCP/UDP checks, use:

nc -vz 10.0.2.101 80

3) Confirm application response

Check logs or application output. For Nginx, for example:

sudo tail -n 100 /var/log/nginx/access.log
sudo tail -n 100 /var/log/nginx/error.log

If you see requests reaching Nginx but getting 404/403, you’re past the “network plumbing” stage and into “configuration logic.” If you see nothing, you’re still dealing with networking or firewall.

Troubleshooting: When Things Go Sideways (They Will)

Here’s a non-exhaustive list of problems you might encounter, along with the likely causes and fixes.

Problem 1: The secondary IP doesn’t show up in the OS

Symptoms: ENI has the secondary IP in the control plane, but ip addr doesn’t show it.

Causes: OS doesn’t auto-configure secondary addresses; you attached the ENI but didn’t run OS-level config; wrong interface name; IP added but netplan/NetworkManager not updated.

Fix: Identify the correct interface and run:

sudo ip addr add YOUR_IP/24 dev YOUR_IFACE

Then persist properly in your system’s network configuration.

Problem 2: Ping fails, but the IP is configured

Symptoms: ip addr shows the address, but ping from another host fails.

Causes: Security group doesn’t allow ICMP; host firewall blocks ICMP; app-level blocks; rp_filter issues; wrong subnet mask causing routing mismatch.

Tencent Cloud Account for Sale Fix: Test from the same subnet and check security groups/host firewall. Also verify netmask:

ip addr show dev YOUR_IFACE

Ensure the secondary IP uses the correct CIDR prefix.

Problem 3: Port is open locally but unreachable remotely

Symptoms: From the server itself, the service works; from outside, it doesn’t.

Causes: Cloud firewall/security group rules; host firewall rules; service is bound to 127.0.0.1 only; service is bound to a different interface/IP.

Fix: Confirm listeners:

sudo ss -lntup | grep :80

Make sure it listens on 0.0.0.0 or the correct secondary IP. Then open the cloud and host firewall for that port.

Problem 4: Random timeouts after adding multiple IPs

Symptoms: Some IPs work, others don’t, or traffic intermittently fails.

Causes: Asymmetric routing; rp_filter dropping replies; missing policy routing; application using bind() behavior not matching all destinations.

Fix: Check rp_filter and routing consistency. For advanced setups, you might need policy routing rules. Many simpler deployments avoid asymmetric routing by design.

Problem 5: The cloud ENI shows changes, but connectivity never comes back

Symptoms: You add secondary IPs, but still no connectivity.

Causes: ENI attached to wrong instance; ENI in different subnet; IP conflicts; stale ARP entries on clients; instance network manager not reloading.

Fix: Confirm ENI attachment and subnet alignment. Verify no IP conflicts exist. On clients, flushing ARP can help:

ip neigh flush all

(Do this carefully; it affects connectivity temporarily.)

Optional Advanced Design: Using Multiple ENIs

If you decide to use multiple ENIs (Option B), the workflow is similar, but OS interface mapping becomes more important.

Conceptually:

Create multiple ENIs in the same subnet or relevant subnets.
Attach each ENI to the instance.
OS will show additional interfaces (e.g., eth0, eth1).
Assign primary/secondary IPs to the respective interface in the OS.
Bind services accordingly and adjust firewall policies.

Benefits: separation and clearer control. Tradeoff: more moving parts, more interfaces, and more chances to misconfigure the wrong NIC.

Performance and Operational Considerations

When you add multiple IPs, you’re not just changing labels—you’re changing how clients and the network stack interpret destinations. Most workloads won’t notice a measurable performance difference. But be mindful of operational complexity:

Monitoring: ensure your monitoring includes per-IP checks if needed.
: include destination IP in logs if you route by IP.
: ensure IP persistence survives reboots and automation pipelines.
: each IP may represent a different trust boundary depending on how you configure services.

Also consider IP lifecycle: if you remove secondary IPs from ENI in the control plane, you should remove them in the OS too (or at least ensure your persistence config doesn’t re-add them).

A Practical Checklist (Use This Like a Recipe)

Here’s a condensed checklist you can run through when implementing multi-IP binding via ENI:

Create or identify the ENI attached to your CVM.
Add secondary private IPs to that ENI in the same subnet.
Tencent Cloud Account for Sale In the OS, identify the correct interface name (use ip link show and ip addr).
Add secondary IPs to the interface (use ip addr add IP/CIDR dev iface).
Persist the configuration so reboots keep the IPs.
Ensure your service listens on the correct IPs (or on all interfaces).
Verify cloud security group rules for relevant ports and sources.
Verify host firewall rules for relevant ports and protocols.
Test from local and remote hosts (ping, nc/curl, and check logs).
Troubleshoot routing/firewall/rp_filter if connectivity fails.

Frequently Asked Questions

Can I bind any random IP to the ENI?

Tencent Cloud Account for Sale No. Secondary IPs must belong to the subnet and comply with cloud constraints. If an IP isn’t in the correct subnet range or isn’t allocated/allowed, you’ll either fail to add it or cause conflicts.

Do I need to restart the instance after adding ENI secondary IPs?

Usually you don’t need to restart. But some OS networking stacks or configuration systems might require reload/reapply. If you make persistent network config changes, you may need to apply config rather than reboot.

Will services automatically listen on the new IPs?

Only if they’re listening on all interfaces (like 0.0.0.0) or otherwise configured to accept connections for the new destinations. If you bound a service to a specific IP, you must update its configuration.

Is this the best approach for multi-tenant hosting?

It can be, especially for IP-based virtual hosting and routing. But consider simpler approaches (like hostnames with load balancers) if available. IP-based separation is powerful, but it’s also operationally heavier.

Conclusion: Your Multi-IP Setup, Now With Less Chaos

Binding multiple IPs to a CVM via ENI is one of those tasks that sounds like it should be a single click—but it’s actually a sequence of steps across the cloud control plane and your guest OS. The good news is: once you understand the pattern, it becomes repeatable.

To summarize the heart of it:

Use ENI to make secondary private IPs exist at the cloud networking level.
Make the OS aware of those IPs via ip addr add (and persist it).
Ensure your services listen on the right addresses.
Verify both cloud security group and host firewall rules.
Test end-to-end and troubleshoot with routing/firewall/logs when necessary.

Once you’ve done it a couple times, you’ll start to feel like the network is finally cooperating. And if it still doesn’t, remember: networks rarely break randomly. They break for reasons. Usually those reasons are sitting right there in your logs—waiting to be judged.

If you want, tell me your Linux distro, the ENI interface name (like eth0), and the IPs/CIDR you’re trying to use. I can generate a tailored, copy-paste-friendly configuration for your exact environment.