A method for configuring communication between a virtual private cloud VPC and an on-premises data center, wherein a first virtual private cloud VPC and a subnet of the on-premises data center that have a same private network address segment communicate with each other by using a second VPC, wherein the second VPC is used as a large internal network of an enterprise, and wherein the first VPC is used as a small internal network of the enterprise, and a private network address segment of the second VPC is different from private network address segments of the first VPC and the subnet; and the method comprises: configuring a network address translation NAT gateway on the first VPC to form a connection between the NAT gateway and the second VPC, and configuring a remote connection gateway on the second VPC to form a remote connection between the remote connection gateway and the subnet of the on-premises data center, wherein a first address is configured for the NAT gateway, a second address is configured for the remote connection gateway, the first address and the second address belong to the private network address segment of the second VPC, and the first address is different from the second address; and configuring (S105, S106) a first packet processing rule and a second packet processing rule on the NAT gateway, wherein the first packet processing rule comprises: translating a source address of an outbound packet from a private network address in the first VPC into the first address, translating a destination address of the outbound packet from the second address into a private network address in the subnet, and sending a modified outbound packet to a router of the second VPC; and the second packet processing rule comprises: modifying a source address of an inbound packet from the private network address in the subnet into the second address, translating a destination address of the inbound packet from the first address into the private network address in the first VPC, and sending a modified inbound packet to a router of the first VPC. configuring a network address translation NAT gateway on the first VPC to form a connection between the NAT gateway and the second VPC, and configuring a remote connection gateway on the second VPC to form a remote connection between the remote connection gateway and the subnet of the on-premises data center, wherein a first address is configured for the NAT gateway, a second address is configured for the remote connection gateway, the first address and the second address belong to the private network address segment of the second VPC, and the first address is different from the second address; and configuring (S105, S106) a first packet processing rule and a second packet processing rule on the NAT gateway, wherein the first packet processing rule comprises: translating a source address of an outbound packet from a private network address in the first VPC into the first address, translating a destination address of the outbound packet from the second address into a private network address in the subnet, and sending a modified outbound packet to a router of the second VPC; and the second packet processing rule comprises: modifying a source address of an inbound packet from the private network address in the subnet into the second address, translating a destination address of the inbound packet from the first address into the private network address in the first VPC, and sending a modified inbound packet to a router of the first VPC.