Re: [PATCH network v2 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets

["Lukas Sichert" <l.sichert@proxmox.com>]

Thanks for looking into it. I will send a v3. Some Comments are inline.

On 2026-06-08 11:46, Gabriel Goller <g.goller@proxmox.com> wrote:

> On 03.06.2026 16:29, Lukas Sichert wrote:
>> EVPN zones can route IPv6 subnet traffic through a VNet and an outgoing
>> interface. Until now, this depended on global IPv6 forwarding state,
>> which also changes Router Advertisement handling for the whole host.
>> 
>> Use the per-interface 'force_forwarding' setting instead. For IPv6
>> subnets that need forwarding, generate post-up/post-down commands for
>> both the VNet interface and the outgoing interface. Track interfaces
>> that already received 'force_forwarding' commands to avoid duplicates
>> when multiple subnets share the same outgoing path. Update the expected
>> SDN interface output in the zone tests accordingly.
>> 
>> Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
>> ---
>>  src/PVE/Network/SDN/Zones/EvpnPlugin.pm       | 20 +++++++++++++++----
>>  .../expected_sdn_interfaces                   |  4 ++++
>>  .../exitnode_snat/expected_sdn_interfaces     |  4 ++++
>>  .../exitnodenullroute/expected_sdn_interfaces |  4 ++++
>>  .../evpn/ipv4ipv6/expected_sdn_interfaces     |  4 ++++
>>  .../zones/evpn/ipv6/expected_sdn_interfaces   |  4 ++++
>>  .../evpn/ipv6underlay/expected_sdn_interfaces |  4 ++++
>>  7 files changed, 40 insertions(+), 4 deletions(-)
>> 
>> diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
>> index dfbd7e9..7622457 100644
>> --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
>> +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
>> @@ -238,11 +238,13 @@ sub generate_sdn_config {
>>      my $ipv6 = undef;
>>      my $enable_forward_v4 = undef;
>>      my $enable_forward_v6 = undef;
>> +    my $force_forward_enabled = {};
>>      my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
>>      foreach my $subnetid (sort keys %{$subnets}) {
>>          my $subnet = $subnets->{$subnetid};
>>          my $cidr = $subnet->{cidr};
>>          my $mask = $subnet->{mask};
>> +        my $vnet = $subnet->{vnet};
>>  
>>          my $gateway = $subnet->{gateway};
>>          if ($gateway) {
>> @@ -266,11 +268,21 @@ sub generate_sdn_config {
>>              $enable_forward_v4 = 1 if $gateway;
>>          }
>>  
>> -        if ($subnet->{snat}) {
>> +        #find outgoing interface
>> +        my ($outip, $outiface) =
>> +            PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
>
> Hmm this is now outside the snat branch, so we will run `ip route get 8.8.8.8`
> for subnets without a gateway and with snat enabled, which will always fail.
>
> Could it be that without gateway or snat there isn't an outgoing interface and
> thus no need to set force_forwarding?

The 'get_local_route_ip' does not depend on the zone. '$checkrouteip' is
only the IPv4/IPv6 address of google to resolve the outgoing interface.
So as long as there is an interface, that has an ip address of the same
version as the google address and that has internet access, it won't
fail. If it fails, then the if clause below would prevent any
'force_forwarding' from being set, but actually it throws an error and
aborts the loop. There is a patch already to make it fail gracefully and
not abort the loop iterating through the subnets.[1]

>
>> +
>> +        if ($outiface && $enable_forward_v6 && !($force_forward_enabled->{$outiface})) {
>
> Will this enable force_forwarding on a ipv4 subnet if there is a ipv6 subnet
> that sets $enable_forward_v6 followed by a ipv4 subnet? I think we need to reset
> the $enable_forward_v6 variable before the loop?

Yes, also, if the '$enable_forward_v6' is set once, then for all
subsequent nets, it remains set. Thanks for pointing it out.

>
>> +            push @iface_config,
>> +                "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
>> +            push @iface_config,
>> +                "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
>> +            push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnet/force_forwarding";
>> +            push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnet/force_forwarding";
>
> Could it happen here that with the post-down we can bring down a shared
> interface? e.g. if a zone/vnet use the same vmbr0 bridge and then deleting one
> removes the force_forwarding on the other one?
>
> Not sure if this can happen. If yes, we could either just remove the post-down
> or add some complicated ref-couting (not a fan of that).

But wouldn't this require manually executing 'ifdown <vnet>'? Because
for a normal SDN-Apply the whole configuration would be regenerated and
the 'post-down' commands removed.

[1] https://lore.proxmox.com/all/20260601124228.77298-1-l.sichert@proxmox.com/