* [PATCH network v4 1/6] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
2026-07-27 13:55 [PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
@ 2026-07-27 13:55 ` Lukas Sichert
2026-07-27 13:55 ` [PATCH network v4 2/6] sdn: simple: " Lukas Sichert
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Lukas Sichert @ 2026-07-27 13:55 UTC (permalink / raw)
To: pve-devel; +Cc: Lukas Sichert
EVPN zones can route IPv6 subnet traffic through a VNet, an outgoing
interface, and, for L3VNI setups, a VRF bridge. Until now, this depended
on global IPv6 forwarding state, which also changes Router Advertisement
handling for the whole host.
Use the per-interface 'force_forwarding' setting instead. For IPv6
subnets that need forwarding, generate post-up/post-down commands for
the VNet interface, the outgoing interface, and the EVPN VRF bridge
where applicable.
Update the expected SDN interface output in the zone tests accordingly
Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 34 ++++++++++++++++++-
.../expected_sdn_interfaces | 6 ++++
.../exitnode_snat/expected_sdn_interfaces | 4 +++
.../exitnodenullroute/expected_sdn_interfaces | 6 ++++
.../evpn/ipv4ipv6/expected_sdn_interfaces | 4 +++
.../zones/evpn/ipv6/expected_sdn_interfaces | 4 +++
.../evpn/ipv6underlay/expected_sdn_interfaces | 4 +++
7 files changed, 61 insertions(+), 1 deletion(-)
diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index 0e79707..80de5bf 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -302,7 +302,32 @@ sub generate_sdn_config {
push @iface_config, "mtu $mtu" if $mtu;
push @iface_config, "alias $alias" if $alias;
push @iface_config, "ip-forward on" if $enable_forward_v4;
- push @iface_config, "ip6-forward on" if $enable_forward_v6;
+
+ if ($enable_forward_v6) {
+ push @iface_config, "ip6-forward on";
+
+ push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
+ push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
+
+ if ($is_evpn_gateway) {
+ #find outgoing ipv6 interface
+ my ($outip, $outiface);
+ eval {
+ ($outip, $outiface) =
+ PVE::Network::SDN::Zones::Plugin::get_local_route_ip('2001:4860:4860::8888');
+ };
+ if ($@) {
+ my $msg = "interface for IPv6 forwarding could not be resolved: $@";
+ log_warn($msg);
+ } elsif ($outiface) {
+ push @iface_config,
+ "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
+ push @iface_config,
+ "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
+ }
+ }
+ }
+
push @iface_config, "arp-accept on" if $ipv4 || $ipv6;
push @iface_config, "vrf $vrf_iface" if $vrf_iface;
push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid};
@@ -342,6 +367,13 @@ sub generate_sdn_config {
push @iface_config, "bridge_fd 0";
push @iface_config, "mtu $mtu" if $mtu;
push @iface_config, "vrf $vrf_iface";
+
+ if ($enable_forward_v6) {
+ push @iface_config,
+ "post-up echo 1 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
+ push @iface_config,
+ "post-down echo 0 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
+ }
push(@{ $config->{$brvrf} }, @iface_config) if !$config->{$brvrf};
}
diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
index b46d4e7..7b8dc3c 100644
--- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
@@ -8,6 +8,10 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -23,6 +27,8 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
index 0d7d174..2addde0 100644
--- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
@@ -27,6 +27,10 @@ iface myvnet2
bridge_fd 0
mtu 1450
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
arp-accept on
vrf vrf_myzone
diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
index 4bf5ccf..e406258 100644
--- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
@@ -14,6 +14,10 @@ iface myvnet
mtu 1450
ip-forward on
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -47,6 +51,8 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfbr_myzone2
iface vrfbr_myzone2
diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
index 7a5d741..a1fdb2b 100644
--- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
@@ -11,6 +11,8 @@ iface myvnet
mtu 1450
ip-forward on
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -26,6 +28,8 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
index b2bdbfe..4363842 100644
--- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
@@ -9,6 +9,8 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -24,6 +26,8 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
index 3b91f75..7aaf569 100644
--- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
@@ -9,6 +9,8 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -24,6 +26,8 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfvx_myzone
iface vrfvx_myzone
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH network v4 2/6] sdn: simple: enable force_forwarding for ipv6 forwarding to subnets
2026-07-27 13:55 [PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
2026-07-27 13:55 ` [PATCH network v4 1/6] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets Lukas Sichert
@ 2026-07-27 13:55 ` Lukas Sichert
2026-07-27 13:55 ` [PATCH perl-rs v4 3/6] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic Lukas Sichert
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Lukas Sichert @ 2026-07-27 13:55 UTC (permalink / raw)
To: pve-devel; +Cc: Lukas Sichert
Simple zones can route ipv6 subnet traffic through a VNet bridge. Until
now, this depended on global ipv6 forwarding state, which also changes
Router Advertisement handling for the whole host.
Use the per-interface 'force_forwarding' setting instead. For ipv6
subnets that need forwarding, generate post-up/post-down commands for
both the VNet interface and the outgoing interface.
Update the expected SDN interface output in the zone tests accordingly.
Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
src/PVE/Network/SDN/Zones/SimplePlugin.pm | 25 ++++++++++++++++++-
.../simple/ipv4v6/expected_sdn_interfaces | 4 +++
.../simple/ipv6snat/expected_sdn_interfaces | 4 +++
3 files changed, 32 insertions(+), 1 deletion(-)
diff --git a/src/PVE/Network/SDN/Zones/SimplePlugin.pm b/src/PVE/Network/SDN/Zones/SimplePlugin.pm
index 347eee9..854a761 100644
--- a/src/PVE/Network/SDN/Zones/SimplePlugin.pm
+++ b/src/PVE/Network/SDN/Zones/SimplePlugin.pm
@@ -149,7 +149,30 @@ sub generate_sdn_config {
push @iface_config, "mtu $mtu" if $mtu;
push @iface_config, "alias $alias" if $alias;
push @iface_config, "ip-forward on" if $enable_forward_v4;
- push @iface_config, "ip6-forward on" if $enable_forward_v6;
+
+ if ($enable_forward_v6) {
+ push @iface_config, "ip6-forward on";
+
+ push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
+ push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
+
+ #find outgoing ipv6 interface
+ my ($outip, $outiface);
+ eval {
+ ($outip, $outiface) =
+ PVE::Network::SDN::Zones::Plugin::get_local_route_ip('2001:4860:4860::8888');
+ };
+ if ($@) {
+ my $msg = "interface for IPv6 forwarding could not be resolved: $@";
+ log_warn($msg);
+ } elsif ($outiface) {
+ push @iface_config,
+ "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
+ push @iface_config,
+ "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
+ }
+
+ }
push @{ $config->{$vnetid} }, @iface_config;
diff --git a/src/test/zones/simple/ipv4v6/expected_sdn_interfaces b/src/test/zones/simple/ipv4v6/expected_sdn_interfaces
index 34ed5db..61b7258 100644
--- a/src/test/zones/simple/ipv4v6/expected_sdn_interfaces
+++ b/src/test/zones/simple/ipv4v6/expected_sdn_interfaces
@@ -9,3 +9,7 @@ iface myvnet
bridge_fd 0
ip-forward on
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
diff --git a/src/test/zones/simple/ipv6snat/expected_sdn_interfaces b/src/test/zones/simple/ipv6snat/expected_sdn_interfaces
index 5f6d40b..4df3371 100644
--- a/src/test/zones/simple/ipv6snat/expected_sdn_interfaces
+++ b/src/test/zones/simple/ipv6snat/expected_sdn_interfaces
@@ -11,3 +11,7 @@ iface myvnet
bridge_stp off
bridge_fd 0
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH perl-rs v4 3/6] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic
2026-07-27 13:55 [PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
2026-07-27 13:55 ` [PATCH network v4 1/6] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets Lukas Sichert
2026-07-27 13:55 ` [PATCH network v4 2/6] sdn: simple: " Lukas Sichert
@ 2026-07-27 13:55 ` Lukas Sichert
2026-07-27 13:55 ` [PATCH perl-rs v4 4/6] fabrics: bgp: " Lukas Sichert
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Lukas Sichert @ 2026-07-27 13:55 UTC (permalink / raw)
To: pve-devel; +Cc: Lukas Sichert
In a non-full-mesh OpenFabric setup, nodes may need to relay traffic
between peers that are not directly connected. This requires forwarding
ipv6 packets between fabric bridges. With the addition of
'force_forwarding' to the Linux kernel, this can be done without
enabling 'all.forwarding', which disables Router Advertisements.
Configure fabric bridges with the required 'post-up'/'post-down'
commands to enable 'force_forwarding'.
Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
pve-rs/src/bindings/sdn/fabrics.rs | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/pve-rs/src/bindings/sdn/fabrics.rs b/pve-rs/src/bindings/sdn/fabrics.rs
index f96b6b1..785b537 100644
--- a/pve-rs/src/bindings/sdn/fabrics.rs
+++ b/pve-rs/src/bindings/sdn/fabrics.rs
@@ -596,6 +596,16 @@ pub mod pve_rs_sdn_fabrics {
writeln!(interface, "\tlink-type {link_type}")?;
}
writeln!(interface, "\tip-forward 1")?;
+ if cidr.is_ipv6() {
+ writeln!(
+ interface,
+ "\tpost-up echo 1 > /proc/sys/net/ipv6/conf/{name}/force_forwarding"
+ )?;
+ writeln!(
+ interface,
+ "\tpost-down echo 0 > /proc/sys/net/ipv6/conf/{name}/force_forwarding"
+ )?;
+ }
Ok(interface)
}
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH perl-rs v4 4/6] fabrics: bgp: enable force_forwarding for ipv6 transit traffic
2026-07-27 13:55 [PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
` (2 preceding siblings ...)
2026-07-27 13:55 ` [PATCH perl-rs v4 3/6] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic Lukas Sichert
@ 2026-07-27 13:55 ` Lukas Sichert
2026-07-27 13:55 ` [PATCH manager v4 5/6] ui: sdn: remove IPv6 forwarding hint from fabric edit window Lukas Sichert
2026-07-27 13:55 ` [PATCH docs v4 6/6] sdn: drop global ipv6 forwarding workaround from OpenFabric docs Lukas Sichert
5 siblings, 0 replies; 7+ messages in thread
From: Lukas Sichert @ 2026-07-27 13:55 UTC (permalink / raw)
To: pve-devel; +Cc: Lukas Sichert
In a non-full-mesh BGP-fabric setup, nodes may need to relay traffic
between peers that are not directly connected. This requires forwarding
ipv6 packets between fabric bridges. With the addition of
'force_forwarding' to the Linux kernel, this can be done without
enabling 'all.forwarding', which disables Router Advertisements.
Configure fabric bridges with the required 'post-up'/'post-down'
commands to enable 'force_forwarding'.
Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
pve-rs/src/bindings/sdn/fabrics.rs | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/pve-rs/src/bindings/sdn/fabrics.rs b/pve-rs/src/bindings/sdn/fabrics.rs
index 785b537..000ecb7 100644
--- a/pve-rs/src/bindings/sdn/fabrics.rs
+++ b/pve-rs/src/bindings/sdn/fabrics.rs
@@ -774,6 +774,14 @@ pub mod pve_rs_sdn_fabrics {
writeln!(interfaces, "iface {name} inet manual")?;
writeln!(interfaces, "\tip-forward 1")?;
writeln!(interfaces, "\tip6-forward 1")?;
+ writeln!(
+ interfaces,
+ "\tpost-up echo 1 > /proc/sys/net/ipv6/conf/{name}/force_forwarding"
+ )?;
+ writeln!(
+ interfaces,
+ "\tpost-down echo 0 > /proc/sys/net/ipv6/conf/{name}/force_forwarding"
+ )?;
// BGP unnumbered uses RAs to discover peer link-local
// addresses. frr listens for them itself, but the kernel
// would otherwise install RA-derived routes we don't want.
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH manager v4 5/6] ui: sdn: remove IPv6 forwarding hint from fabric edit window
2026-07-27 13:55 [PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
` (3 preceding siblings ...)
2026-07-27 13:55 ` [PATCH perl-rs v4 4/6] fabrics: bgp: " Lukas Sichert
@ 2026-07-27 13:55 ` Lukas Sichert
2026-07-27 13:55 ` [PATCH docs v4 6/6] sdn: drop global ipv6 forwarding workaround from OpenFabric docs Lukas Sichert
5 siblings, 0 replies; 7+ messages in thread
From: Lukas Sichert @ 2026-07-27 13:55 UTC (permalink / raw)
To: pve-devel; +Cc: Lukas Sichert
The fabric edit window warned users to enable global IPv6 forwarding
when configuring an IPv6 fabric prefix. This is no longer required, as
the SDN backend now enables per-interface IPv6 forwarding where needed
via force_forwarding.
Remove the hint to avoid suggesting the broader host-wide sysctl
setting, which can disable Router Advertisements on the host.
Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
www/manager6/sdn/fabrics/FabricEdit.js | 59 +++++++++-----------------
1 file changed, 20 insertions(+), 39 deletions(-)
diff --git a/www/manager6/sdn/fabrics/FabricEdit.js b/www/manager6/sdn/fabrics/FabricEdit.js
index e9e0d1fa..a8c71785 100644
--- a/www/manager6/sdn/fabrics/FabricEdit.js
+++ b/www/manager6/sdn/fabrics/FabricEdit.js
@@ -13,12 +13,6 @@ Ext.define('PVE.sdn.Fabric.Fabric.Edit', {
baseUrl: '/cluster/sdn/fabrics/fabric',
- viewModel: {
- data: {
- showIpv6ForwardingHint: false,
- },
- },
-
items: [
{
xtype: 'textfield',
@@ -83,42 +77,29 @@ Ext.define('PVE.sdn.Fabric.Fabric.Edit', {
}
if (me.hasIpv6Support) {
- me.items.push(
- {
- xtype: 'displayfield',
- value: 'To make IPv6 fabrics work, enable global IPv6 forwarding on all nodes. Click on the Help button for more details.',
- bind: {
- hidden: '{!showIpv6ForwardingHint}',
- },
- userCls: 'pmx-hint',
+ me.items.push({
+ xtype: 'proxmoxtextfield',
+ fieldLabel: gettext('IPv6 Prefix'),
+ labelWidth: 120,
+ name: 'ip6_prefix',
+ disabled: me.disableIpPrefixEdit,
+ allowBlank: true,
+ vtype: 'IP6CIDRAddress',
+ skipEmptyText: true,
+ deleteEmpty: !me.isCreate,
+ validator: function (value) {
+ let ipPrefix = this.up('window').down('[name=ip_prefix]')?.getValue();
+ if (value || ipPrefix) {
+ return true;
+ }
+ return gettext('Either IPv4 Prefix or IPv6 Prefix is required');
},
- {
- xtype: 'proxmoxtextfield',
- fieldLabel: gettext('IPv6 Prefix'),
- labelWidth: 120,
- name: 'ip6_prefix',
- disabled: me.disableIpPrefixEdit,
- allowBlank: true,
- vtype: 'IP6CIDRAddress',
- skipEmptyText: true,
- deleteEmpty: !me.isCreate,
- validator: function (value) {
- let ipPrefix = this.up('window').down('[name=ip_prefix]')?.getValue();
- if (value || ipPrefix) {
- return true;
- }
- return gettext('Either IPv4 Prefix or IPv6 Prefix is required');
- },
- listeners: {
- change: function (textbox, value) {
- let win = textbox.up('window');
- let vm = win.getViewModel();
- vm.set('showIpv6ForwardingHint', !!value);
- win.down('[name=ip_prefix]')?.validate();
- },
+ listeners: {
+ change: function (textbox) {
+ textbox.up('window').down('[name=ip_prefix]')?.validate();
},
},
- );
+ });
}
if (me.additionalTabs.length > 0) {
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH docs v4 6/6] sdn: drop global ipv6 forwarding workaround from OpenFabric docs
2026-07-27 13:55 [PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
` (4 preceding siblings ...)
2026-07-27 13:55 ` [PATCH manager v4 5/6] ui: sdn: remove IPv6 forwarding hint from fabric edit window Lukas Sichert
@ 2026-07-27 13:55 ` Lukas Sichert
5 siblings, 0 replies; 7+ messages in thread
From: Lukas Sichert @ 2026-07-27 13:55 UTC (permalink / raw)
To: pve-devel; +Cc: Lukas Sichert
OpenFabric fabrics with ipv6 need forwarding on transit nodes so packets
can be relayed between peers that are not directly connected.
Drop the old recommendation to enable host-wide
net.ipv6.conf.all.forwarding from the documentation. The generated fabric
interface configuration now handles the required forwarding setup, so the
manual global forwarding workaround is no longer needed.
Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
pvesdn.adoc | 21 +++++----------------
1 file changed, 5 insertions(+), 16 deletions(-)
diff --git a/pvesdn.adoc b/pvesdn.adoc
index d20a0eb..d11fec7 100644
--- a/pvesdn.adoc
+++ b/pvesdn.adoc
@@ -604,23 +604,12 @@ behavior and proper source address selection throughout the fabric.
Notes on IPv6
^^^^^^^^^^^^^
-IPv6 is currently only usable on OpenFabric fabrics. These IPv6 Fabrics need
-global IPv6 forwarding enabled on all nodes contained in the fabric. Without
+IPv6 is currently only usable on OpenFabric and BGP fabrics. These IPv6 Fabrics
+need IPv6 forwarding enabled on all transit nodes contained in the fabric. Without
IPv6 forwarding, non-full-mesh fabrics won't work because the transit nodes
-don't forward packets to the outer nodes. Currently there isn't an easy way to
-enable IPv6 forwarding per-interface like with IPv4, so it has to be enabled
-globally. This can be accomplished by appending this line:
-
-----
-post-up sysctl -w net.ipv6.conf.all.forwarding=1
-----
-
-to a fabric interface in the `/etc/network/interfaces` file. This will enable
-IPv6 forwarding globally once that interface comes up. Note that this affects
-how your interfaces handle automatic IPv6 setup (SLAAC), Neighbour
-Advertisements, Router Solicitations, and Router Advertisements. More details
-here: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt under
-`net.ipv6.conf.all.forwarding`.
+don't forward packets to the outer nodes. IPv6 forwarding is enabled by default
+on the necessary interfaces using the force_forwarding flag. More details here:
+docs.kernel.org/networking/ip-sysctl.html
[[pvesdn_openfabric]]
OpenFabric
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread