Re: [PATCH network v3 2/5] sdn: simple: enable force_forwarding for ipv6 forwarding to subnets

[Stefan Hanreich <s.hanreich@proxmox.com>]

On 6/19/26 5:40 PM, Lukas Sichert wrote:
> Simple zones can route ipv6 subnet traffic through a VNet bridge. Until
> now, this depended on global ipv6 forwarding state, which also changes
> Router Advertisement handling for the whole host.
> 
> Use the per-interface 'force_forwarding' setting instead. For ipv6
> subnets that need forwarding, generate post-up/post-down commands for
> both the VNet interface and the outgoing interface. Track interfaces
> that already received 'force_forwarding' commands to avoid duplicates
> when multiple subnets share the same outgoing path.
> Update the expected SDN interface output in the zone tests accordingly.
> 
> Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
> ---
>  src/PVE/Network/SDN/Zones/SimplePlugin.pm        | 16 ++++++++++++++--
>  .../zones/simple/ipv4v6/expected_sdn_interfaces  |  4 ++++
>  .../simple/ipv6snat/expected_sdn_interfaces      |  4 ++++
>  3 files changed, 22 insertions(+), 2 deletions(-)
> 
> diff --git a/src/PVE/Network/SDN/Zones/SimplePlugin.pm b/src/PVE/Network/SDN/Zones/SimplePlugin.pm
> index f5cd18e..47ed170 100644
> --- a/src/PVE/Network/SDN/Zones/SimplePlugin.pm
> +++ b/src/PVE/Network/SDN/Zones/SimplePlugin.pm
> @@ -140,7 +140,20 @@ sub generate_sdn_config {
>      push @iface_config, "mtu $mtu" if $mtu;
>      push @iface_config, "alias $alias" if $alias;
>      push @iface_config, "ip-forward on" if $enable_forward_v4;
> -    push @iface_config, "ip6-forward on" if $enable_forward_v6;
> +
> +    if ($enable_forward_v6) {
> +        push @iface_config, "ip6-forward on";
> +
> +        #find outgoing ipv6 interface
> +        my ($outip, $outiface) =
> +            PVE::Network::SDN::Zones::Plugin::get_local_route_ip('2001:4860:4860::8888');
> +

should this be wrapped in an eval?

> +        push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> +        push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> +
> +        push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
> +        push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
> +    }
>  
>      push @{ $config->{$vnetid} }, @iface_config;
>  
> @@ -168,4 +181,3 @@ sub get_mtu {
>  }
>  
>  1;
> -

nit: also an unrelated whitespace change that's potentially better upfront.

> diff --git a/src/test/zones/simple/ipv4v6/expected_sdn_interfaces b/src/test/zones/simple/ipv4v6/expected_sdn_interfaces
> index 34ed5db..54e5664 100644
> --- a/src/test/zones/simple/ipv4v6/expected_sdn_interfaces
> +++ b/src/test/zones/simple/ipv4v6/expected_sdn_interfaces
> @@ -9,3 +9,7 @@ iface myvnet
>  	bridge_fd 0
>  	ip-forward on
>  	ip6-forward on
> +	post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> +	post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> +	post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> +	post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> diff --git a/src/test/zones/simple/ipv6snat/expected_sdn_interfaces b/src/test/zones/simple/ipv6snat/expected_sdn_interfaces
> index 5f6d40b..46f2441 100644
> --- a/src/test/zones/simple/ipv6snat/expected_sdn_interfaces
> +++ b/src/test/zones/simple/ipv6snat/expected_sdn_interfaces
> @@ -11,3 +11,7 @@ iface myvnet
>  	bridge_stp off
>  	bridge_fd 0
>  	ip6-forward on
> +	post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> +	post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> +	post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> +	post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding