[PATCH network v3 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets

all lists on lists.proxmox.com
 help / color / mirror / Atom feed

From: Lukas Sichert <l.sichert@proxmox.com>
To: pve-devel@lists.proxmox.com
Cc: Lukas Sichert <l.sichert@proxmox.com>
Subject: [PATCH network v3 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
Date: Fri, 19 Jun 2026 17:40:01 +0200	[thread overview]
Message-ID: <20260619154017.167720-2-l.sichert@proxmox.com> (raw)
In-Reply-To: <20260619154017.167720-1-l.sichert@proxmox.com>

EVPN zones can route IPv6 subnet traffic through a VNet, an outgoing
interface, and, for L3VNI setups, a VRF bridge. Until now, this depended
on global IPv6 forwarding state, which also changes Router Advertisement
handling for the whole host.

Use the per-interface 'force_forwarding' setting instead. For IPv6
subnets that need forwarding, generate post-up/post-down commands for
the VNet interface, the outgoing interface, and the EVPN L3VNI VRF bridge
where applicable.
Update the expected SDN interface output in the zone tests accordingly

Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
 src/PVE/Network/SDN/Zones/EvpnPlugin.pm       | 28 +++++++++++++++++--
 .../expected_sdn_interfaces                   |  7 +++++
 .../exitnode_snat/expected_sdn_interfaces     |  4 +++
 .../exitnodenullroute/expected_sdn_interfaces |  7 +++++
 .../evpn/ipv4ipv6/expected_sdn_interfaces     |  7 +++++
 .../zones/evpn/ipv6/expected_sdn_interfaces   |  7 +++++
 .../evpn/ipv6underlay/expected_sdn_interfaces |  7 +++++
 7 files changed, 64 insertions(+), 3 deletions(-)

diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index dfbd7e9..bdbb219 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -238,6 +238,7 @@ sub generate_sdn_config {
     my $ipv6 = undef;
     my $enable_forward_v4 = undef;
     my $enable_forward_v6 = undef;
+
     my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
     foreach my $subnetid (sort keys %{$subnets}) {
         my $subnet = $subnets->{$subnetid};
@@ -267,7 +268,6 @@ sub generate_sdn_config {
         }
 
         if ($subnet->{snat}) {
-
             #find outgoing interface
             my ($outip, $outiface) =
                 PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
@@ -293,7 +293,21 @@ sub generate_sdn_config {
     push @iface_config, "mtu $mtu" if $mtu;
     push @iface_config, "alias $alias" if $alias;
     push @iface_config, "ip-forward on" if $enable_forward_v4;
-    push @iface_config, "ip6-forward on" if $enable_forward_v6;
+
+    if ($enable_forward_v6) {
+        push @iface_config, "ip6-forward on";
+
+        #find outgoing ipv6 interface
+        my ($outip, $outiface) =
+            PVE::Network::SDN::Zones::Plugin::get_local_route_ip('2001:4860:4860::8888');
+
+        push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
+        push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
+
+        push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
+        push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
+    }
+
     push @iface_config, "arp-accept on" if $ipv4 || $ipv6;
     push @iface_config, "vrf $vrf_iface" if $vrf_iface;
     push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid};
@@ -333,6 +347,15 @@ sub generate_sdn_config {
             push @iface_config, "bridge_fd 0";
             push @iface_config, "mtu $mtu" if $mtu;
             push @iface_config, "vrf $vrf_iface";
+
+            if ($enable_forward_v6) {
+                push @iface_config, 'ip6-forward on';
+
+                push @iface_config,
+                    "post-up echo 1 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
+                push @iface_config,
+                    "post-down echo 0 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
+            }
             push(@{ $config->{$brvrf} }, @iface_config) if !$config->{$brvrf};
         }
 
@@ -432,4 +455,3 @@ sub vnet_update_hook {
 }
 
 1;
-
diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
index b46d4e7..ea2ef9a 100644
--- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
@@ -8,6 +8,10 @@ iface myvnet
 	bridge_fd 0
 	mtu 1450
 	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
 	arp-accept on
 	vrf vrf_myzone
 
@@ -23,6 +27,9 @@ iface vrfbr_myzone
 	bridge_fd 0
 	mtu 1450
 	vrf vrf_myzone
+	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
 
 auto vrfvx_myzone
 iface vrfvx_myzone
diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
index 0d7d174..ee907bf 100644
--- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
@@ -27,6 +27,10 @@ iface myvnet2
 	bridge_fd 0
 	mtu 1450
 	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
 	arp-accept on
 	vrf vrf_myzone
 
diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
index 4bf5ccf..5a378b4 100644
--- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
@@ -14,6 +14,10 @@ iface myvnet
 	mtu 1450
 	ip-forward on
 	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
 	arp-accept on
 	vrf vrf_myzone
 
@@ -47,6 +51,9 @@ iface vrfbr_myzone
 	bridge_fd 0
 	mtu 1450
 	vrf vrf_myzone
+	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
 
 auto vrfbr_myzone2
 iface vrfbr_myzone2
diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
index 7a5d741..d9e63ab 100644
--- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
@@ -11,6 +11,10 @@ iface myvnet
 	mtu 1450
 	ip-forward on
 	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
 	arp-accept on
 	vrf vrf_myzone
 
@@ -26,6 +30,9 @@ iface vrfbr_myzone
 	bridge_fd 0
 	mtu 1450
 	vrf vrf_myzone
+	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
 
 auto vrfvx_myzone
 iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
index b2bdbfe..39c07bf 100644
--- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
@@ -9,6 +9,10 @@ iface myvnet
 	bridge_fd 0
 	mtu 1450
 	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
 	arp-accept on
 	vrf vrf_myzone
 
@@ -24,6 +28,9 @@ iface vrfbr_myzone
 	bridge_fd 0
 	mtu 1450
 	vrf vrf_myzone
+	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
 
 auto vrfvx_myzone
 iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
index 3b91f75..13941f4 100644
--- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
@@ -9,6 +9,10 @@ iface myvnet
 	bridge_fd 0
 	mtu 1450
 	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+	post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
 	arp-accept on
 	vrf vrf_myzone
 
@@ -24,6 +28,9 @@ iface vrfbr_myzone
 	bridge_fd 0
 	mtu 1450
 	vrf vrf_myzone
+	ip6-forward on
+	post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+	post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
 
 auto vrfvx_myzone
 iface vrfvx_myzone
-- 
2.47.3

next prev parent reply	other threads:[~2026-06-19 15:41 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-19 15:40 [PATCH docs/network/perl-rs v3 0/5] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
2026-06-19 15:40 ` Lukas Sichert [this message]
2026-06-19 15:40 ` [PATCH network v3 2/5] sdn: simple: enable force_forwarding for ipv6 forwarding to subnets Lukas Sichert
2026-06-19 15:40 ` [PATCH perl-rs v3 3/5] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic Lukas Sichert
2026-06-19 15:40 ` [PATCH perl-rs v3 4/5] fabrics: bgp: " Lukas Sichert
2026-06-19 15:40 ` [PATCH docs v3 5/5] sdn: drop global ipv6 forwarding workaround from OpenFabric docs Lukas Sichert

find likely ancestor, descendant, or conflicting patches for this message:
( dfblob:dfbd7e9 dfblob:bdbb219 dfblob:b46d4e7 dfblob:ea2ef9a
dfblob:0d7d174 dfblob:ee907bf dfblob:4bf5ccf dfblob:5a378b4
dfblob:7a5d741 dfblob:d9e63ab dfblob:b2bdbfe dfblob:39c07bf
dfblob:3b91f75 dfblob:13941f4 )
 OR (
bs:"[PATCH network v3 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets" )
	(help)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260619154017.167720-2-l.sichert@proxmox.com \
    --to=l.sichert@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.

Service provided by Proxmox Server Solutions GmbH | Privacy | Legal