diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go
index cd493193cb..8e22dd8071 100644
--- a/pkg/compute/models/networks.go
+++ b/pkg/compute/models/networks.go
@@ -1391,6 +1391,9 @@ func (manager *SNetworkManager) ValidateCreateData(ctx context.Context, userCred
 		masklen = prefix.MaskLen
 		netAddr = prefix.Address.NetAddr(masklen)
 		input.GuestIpMask = int64(prefix.MaskLen)
+		if masklen >= 30 {
+			return input, httperrors.NewInputParameterError("subnet masklen should be smaller than 30")
+		}
 		// 根据掩码得到合法的GuestIpPrefix
 		input.GuestIpPrefix = prefix.String()
 	} else {
@@ -1487,9 +1490,6 @@ func (manager *SNetworkManager) ValidateCreateData(ctx context.Context, userCred
 		// reserve addresses for onecloud vpc networks
 		masklen := int8(input.GuestIpMask)
 		netAddr := ipStart.NetAddr(masklen)
-		if masklen >= 30 {
-			return input, httperrors.NewInputParameterError("subnet masklen should be smaller than 30")
-		}
 		if netAddr != ipEnd.NetAddr(masklen) {
 			return input, httperrors.NewInputParameterError("start and end ip when masked are not in the same cidr subnet")
 		}
diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go
index 6f6ecdc8bf..1b8a37da82 100644
--- a/pkg/compute/models/vpcs.go
+++ b/pkg/compute/models/vpcs.go
@@ -859,7 +859,7 @@ func (manager *SVpcManager) ValidateCreateData(
 
 	input, err = region.GetDriver().ValidateCreateVpcData(ctx, userCred, input)
 	if err != nil {
-		return input, errors.Wrapf(err, "region.GetDriver().ValidateCreateVpcData")
+		return input, err
 	}
 
 	if region.GetDriver().IsVpcCreateNeedInputCidr() && len(input.CidrBlock) == 0 {
diff --git a/pkg/compute/regiondrivers/aliyun.go b/pkg/compute/regiondrivers/aliyun.go
index f6286d9739..37e935bcc5 100644
--- a/pkg/compute/regiondrivers/aliyun.go
+++ b/pkg/compute/regiondrivers/aliyun.go
@@ -1566,8 +1566,15 @@ func (self *SAliyunRegionDriver) ValidateCreateVpcData(ctx context.Context, user
 	if err := cidrV.Validate(jsonutils.Marshal(input).(*jsonutils.JSONDict)); err != nil {
 		return input, err
 	}
-	if cidrV.Value.MaskLen < 17 || cidrV.Value.MaskLen > 29 {
-		return input, httperrors.NewInputParameterError("%s request the mask range should be between 17 and 29", self.GetProvider())
+
+	err := IsInPrivateIpRange(cidrV.Value.ToIPRange())
+	if err != nil {
+		return input, err
 	}
+
+	if cidrV.Value.MaskLen > 24 {
+		return input, httperrors.NewInputParameterError("invalid cidr range %s, mask length should less than or equal to 24", cidrV.Value.String())
+	}
+
 	return input, nil
 }
diff --git a/pkg/compute/regiondrivers/ctyun.go b/pkg/compute/regiondrivers/ctyun.go
index 49fdd9e4bd..463f3be14a 100644
--- a/pkg/compute/regiondrivers/ctyun.go
+++ b/pkg/compute/regiondrivers/ctyun.go
@@ -82,8 +82,14 @@ func (self *SCtyunRegionDriver) ValidateCreateVpcData(ctx context.Context, userC
 	if err := cidrV.Validate(jsonutils.Marshal(input).(*jsonutils.JSONDict)); err != nil {
 		return input, err
 	}
-	if cidrV.Value.MaskLen < 16 || cidrV.Value.MaskLen > 29 {
-		return input, httperrors.NewInputParameterError("%s request the mask range should be between 16 and 29", self.GetProvider())
+
+	err := IsInPrivateIpRange(cidrV.Value.ToIPRange())
+	if err != nil {
+		return input, err
+	}
+
+	if cidrV.Value.MaskLen > 24 {
+		return input, httperrors.NewInputParameterError("invalid cidr range %s, mask length should less than or equal to 24", cidrV.Value.String())
 	}
 	return input, nil
 }
diff --git a/pkg/compute/regiondrivers/huawei.go b/pkg/compute/regiondrivers/huawei.go
index b57eab9109..f88e1d8a4c 100644
--- a/pkg/compute/regiondrivers/huawei.go
+++ b/pkg/compute/regiondrivers/huawei.go
@@ -2669,8 +2669,14 @@ func (self *SHuaWeiRegionDriver) ValidateCreateVpcData(ctx context.Context, user
 	if err := cidrV.Validate(jsonutils.Marshal(input).(*jsonutils.JSONDict)); err != nil {
 		return input, err
 	}
-	if cidrV.Value.MaskLen < 16 || cidrV.Value.MaskLen > 29 {
-		return input, httperrors.NewInputParameterError("%s request the mask range should be between 16 and 29", self.GetProvider())
+
+	err := IsInPrivateIpRange(cidrV.Value.ToIPRange())
+	if err != nil {
+		return input, err
+	}
+
+	if cidrV.Value.MaskLen > 24 {
+		return input, httperrors.NewInputParameterError("invalid cidr range %s, mask length should less than or equal to 24", cidrV.Value.String())
 	}
 	return input, nil
 }
diff --git a/pkg/compute/regiondrivers/managedvirtual.go b/pkg/compute/regiondrivers/managedvirtual.go
index 2a249209b2..26da140bf3 100644
--- a/pkg/compute/regiondrivers/managedvirtual.go
+++ b/pkg/compute/regiondrivers/managedvirtual.go
@@ -24,6 +24,7 @@ import (
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
+	"yunion.io/x/pkg/util/netutils"
 	"yunion.io/x/pkg/util/secrules"
 	"yunion.io/x/pkg/utils"
 
@@ -3198,3 +3199,20 @@ func (self *SManagedVirtualizationRegionDriver) RequestElasticcacheSetAutoRenew(
 
 	return ec.SetAutoRenew(autoRenew)
 }
+
+func IsInPrivateIpRange(ar netutils.IPV4AddrRange) error {
+	iprs := netutils.GetPrivateIPRanges()
+	match := false
+	for _, ipr := range iprs {
+		if ipr.ContainsRange(ar) {
+			match = true
+			break
+		}
+	}
+
+	if !match {
+		return httperrors.NewInputParameterError("invalid cidr range %s", ar.String())
+	}
+
+	return nil
+}
diff --git a/pkg/compute/regiondrivers/qcloud.go b/pkg/compute/regiondrivers/qcloud.go
index 6eb3b9f317..cb8da3b043 100644
--- a/pkg/compute/regiondrivers/qcloud.go
+++ b/pkg/compute/regiondrivers/qcloud.go
@@ -725,6 +725,12 @@ func (self *SQcloudRegionDriver) ValidateCreateVpcData(ctx context.Context, user
 	if err := cidrV.Validate(jsonutils.Marshal(input).(*jsonutils.JSONDict)); err != nil {
 		return input, err
 	}
+
+	err := IsInPrivateIpRange(cidrV.Value.ToIPRange())
+	if err != nil {
+		return input, err
+	}
+
 	if cidrV.Value.MaskLen < 16 || cidrV.Value.MaskLen > 28 {
 		return input, httperrors.NewInputParameterError("%s request the mask range should be between 16 and 28", self.GetProvider())
 	}
diff --git a/pkg/compute/regiondrivers/ucloud.go b/pkg/compute/regiondrivers/ucloud.go
index 674874749d..bcf8e28f6c 100644
--- a/pkg/compute/regiondrivers/ucloud.go
+++ b/pkg/compute/regiondrivers/ucloud.go
@@ -78,8 +78,13 @@ func (self *SUcloudRegionDriver) ValidateCreateVpcData(ctx context.Context, user
 	if err := cidrV.Validate(jsonutils.Marshal(input).(*jsonutils.JSONDict)); err != nil {
 		return input, err
 	}
-	if cidrV.Value.MaskLen < 16 || cidrV.Value.MaskLen > 29 {
-		return input, httperrors.NewInputParameterError("%s request the mask range should be between 16 and 29", self.GetProvider())
+	err := IsInPrivateIpRange(cidrV.Value.ToIPRange())
+	if err != nil {
+		return input, err
+	}
+
+	if cidrV.Value.MaskLen > 29 {
+		return input, httperrors.NewInputParameterError("%s request the mask range should be less than or equal to 29", self.GetProvider())
 	}
 	return input, nil
 }
diff --git a/pkg/compute/tasks/eip_dissociate_task.go b/pkg/compute/tasks/eip_dissociate_task.go
index fc8aae7ad8..be4a344521 100644
--- a/pkg/compute/tasks/eip_dissociate_task.go
+++ b/pkg/compute/tasks/eip_dissociate_task.go
@@ -126,6 +126,7 @@ func (self *EipDissociateTask) OnInit(ctx context.Context, obj db.IStandaloneMod
 				err := errors.NewAggregate(errs)
 				msg := errors.Wrapf(err, "disassociate eip %s(%s)", eip.Name, eip.Id).Error()
 				self.TaskFail(ctx, eip, jsonutils.NewString(msg), model)
+				return
 			}
 		}
 
@@ -140,9 +141,11 @@ func (self *EipDissociateTask) OnInit(ctx context.Context, obj db.IStandaloneMod
 		logclient.AddActionLogWithStartable(self, model, logclient.ACT_EIP_DISSOCIATE, nil, self.UserCred, true)
 		logclient.AddActionLogWithStartable(self, eip, logOp, nil, self.UserCred, true)
 
-		switch srv := model.(type) {
-		case *models.SGuest:
-			srv.StartSyncstatus(ctx, self.UserCred, "")
+		if !self.IsSubtask() {
+			switch srv := model.(type) {
+			case *models.SGuest:
+				srv.StartSyncstatus(ctx, self.UserCred, "")
+			}
 		}
 	}
 
diff --git a/pkg/compute/tasks/guest_create_task.go b/pkg/compute/tasks/guest_create_task.go
index 433709d424..9321674c8a 100644
--- a/pkg/compute/tasks/guest_create_task.go
+++ b/pkg/compute/tasks/guest_create_task.go
@@ -119,10 +119,12 @@ func (self *GuestCreateTask) OnDeployGuestDescComplete(ctx context.Context, obj
 	{
 		eipId, _ := self.Params.GetString("eip")
 		if len(eipId) > 0 {
+			var err error
 			self.SetStage("OnDeployEipComplete", nil)
 			eipObj, err := models.ElasticipManager.FetchById(eipId)
 			if err != nil {
-				log.Errorf("fail to get eip %s %s", eipId, err)
+				msg := fmt.Sprintf("fail to get eip %s %s", eipId, err)
+				self.OnDeployEipCompleteFailed(ctx, obj, jsonutils.NewString(msg))
 				return
 			}
 
@@ -131,10 +133,15 @@ func (self *GuestCreateTask) OnDeployGuestDescComplete(ctx context.Context, obj
 			eipBw, _ := self.Params.Int("eip_bw")
 			if eipBw > 0 {
 				// newly allocated eip, need allocation and associate
-				eip.AllocateAndAssociateVM(ctx, self.UserCred, guest, self.GetId())
+				err = eip.AllocateAndAssociateVM(ctx, self.UserCred, guest, self.GetId())
 			} else {
 				// existing eip, association only
-				eip.StartEipAssociateInstanceTask(ctx, self.UserCred, guest, self.GetId())
+				err = eip.StartEipAssociateInstanceTask(ctx, self.UserCred, guest, self.GetId())
+			}
+			if err != nil {
+				msg := fmt.Sprintf("fail to asscociate eip %s %s", eipId, err)
+				self.OnDeployEipCompleteFailed(ctx, obj, jsonutils.NewString(msg))
+				return
 			}
 
 			return