[PATCH docs/network/perl-rs v3 0/5] sdn: enable force_forwarding for ipv6 forwarding

[Lukas Sichert <l.sichert@proxmox.com>]

Gabriel's upstream kernel patch [1] added
net.ipv6.conf.<iface>.force_forwarding. This allows enabling IPv6
forwarding on selected interfaces without requiring
net.ipv6.conf.all.forwarding.

This is useful for SDN setups because all.forwarding has host-wide side
effects. In particular, it disables Router Advertisement processing by
default, which can break SLAAC on unrelated interfaces. SDN only needs
forwarding on the VNet, exit-node, or fabric interfaces that participate
in routed IPv6 traffic.

This series generates ifupdown post-up/post-down commands for those
interfaces so force_forwarding is enabled when the interface is brought
up and reset when it is brought down. /network/interfaces.d/sdn gets
regenerated on SDN Apply. This means that removing a VNet also removes
the corresponding 'post-down' commands configured to the interface of
the VNet. Therefore it cannot happen, that deleting one VNet in the GUI
removes force_forwarding on the outgoing interfaces, which might be used
by other VNets as well. The tests are adjusted for the generated
/etc/network/interfaces.d/sdn output. Also the series rewrites the
documentation to reflect the updated behaviour and removes the UI warning
to enable 'all.forwarding'.


[1] lkml.org/lkml/2025/7/7/577

changes from v2 to v3 (thanks @Gabriel):
-Move the IPv6 force_forwarding post-up/post-down commands out of the
subnet loop, so they are generated only once for the VNet instead of
once per subnet.
-Enable ip6-forward and force_forwarding on EVPN L3VNI VRF bridge
interfaces, fixing IPv6 forwarding when traffic exits through another
node.
-Drop the fabric edit GUI hint that told users to enable
net.ipv6.conf.all.forwarding


changes from v1 to v2 (thanks @Gabriel, @Hannes):
-add force_forwarding also to bgp fabrics
-explicitly mention the force_forwarding flag in the documentation
-add a reference link to the sysctl documentation
-mention bgp as a fabric with ipv6 support


network:

Lukas Sichert (2):
  sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
  sdn: simple: enable force_forwarding for ipv6 forwarding to subnets

 src/PVE/Network/SDN/Zones/EvpnPlugin.pm       | 28 +++++++++++++++++--
 src/PVE/Network/SDN/Zones/SimplePlugin.pm     | 16 +++++++++--
 .../expected_sdn_interfaces                   |  7 +++++
 .../exitnode_snat/expected_sdn_interfaces     |  4 +++
 .../exitnodenullroute/expected_sdn_interfaces |  7 +++++
 .../evpn/ipv4ipv6/expected_sdn_interfaces     |  7 +++++
 .../zones/evpn/ipv6/expected_sdn_interfaces   |  7 +++++
 .../evpn/ipv6underlay/expected_sdn_interfaces |  7 +++++
 .../simple/ipv4v6/expected_sdn_interfaces     |  4 +++
 .../simple/ipv6snat/expected_sdn_interfaces   |  4 +++
 10 files changed, 86 insertions(+), 5 deletions(-)


perl-rs:

Lukas Sichert (2):
  fabrics: openfabric: enable force_forwarding for ipv6 transit traffic
  fabrics: bgp: enable force_forwarding for ipv6 transit traffic

 pve-rs/src/bindings/sdn/fabrics.rs | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)


docs:

Lukas Sichert (1):
  sdn: drop global ipv6 forwarding workaround from OpenFabric docs

 pvesdn.adoc | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)


Summary over all repositories:
  12 files changed, 109 insertions(+), 21 deletions(-)

-- 
Generated by murpp 0.12.0