From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: Re: [PATCH network v3 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
Date: Thu, 25 Jun 2026 11:47:58 +0200 [thread overview]
Message-ID: <f7dbcb5b-0965-4198-9547-a86d662a4f14@proxmox.com> (raw)
In-Reply-To: <20260619154017.167720-2-l.sichert@proxmox.com>
On 6/19/26 5:41 PM, Lukas Sichert wrote:
> EVPN zones can route IPv6 subnet traffic through a VNet, an outgoing
> interface, and, for L3VNI setups, a VRF bridge. Until now, this depended
> on global IPv6 forwarding state, which also changes Router Advertisement
> handling for the whole host.
>
> Use the per-interface 'force_forwarding' setting instead. For IPv6
> subnets that need forwarding, generate post-up/post-down commands for
> the VNet interface, the outgoing interface, and the EVPN L3VNI VRF bridge
> where applicable.
> Update the expected SDN interface output in the zone tests accordingly
>
> Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
> ---
> src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 28 +++++++++++++++++--
> .../expected_sdn_interfaces | 7 +++++
> .../exitnode_snat/expected_sdn_interfaces | 4 +++
> .../exitnodenullroute/expected_sdn_interfaces | 7 +++++
> .../evpn/ipv4ipv6/expected_sdn_interfaces | 7 +++++
> .../zones/evpn/ipv6/expected_sdn_interfaces | 7 +++++
> .../evpn/ipv6underlay/expected_sdn_interfaces | 7 +++++
> 7 files changed, 64 insertions(+), 3 deletions(-)
>
> diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> index dfbd7e9..bdbb219 100644
> --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> @@ -238,6 +238,7 @@ sub generate_sdn_config {
> my $ipv6 = undef;
> my $enable_forward_v4 = undef;
> my $enable_forward_v6 = undef;
> +
such whitespace formatting changes are usually better sent upfront,
since they're unrelated to the actual patch.
> my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
> foreach my $subnetid (sort keys %{$subnets}) {
> my $subnet = $subnets->{$subnetid};
> @@ -267,7 +268,6 @@ sub generate_sdn_config {
> }
>
> if ($subnet->{snat}) {
> -
here as well
> #find outgoing interface
> my ($outip, $outiface) =
> PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
> @@ -293,7 +293,21 @@ sub generate_sdn_config {
> push @iface_config, "mtu $mtu" if $mtu;
> push @iface_config, "alias $alias" if $alias;
> push @iface_config, "ip-forward on" if $enable_forward_v4;
> - push @iface_config, "ip6-forward on" if $enable_forward_v6;
> +
> + if ($enable_forward_v6) {
> + push @iface_config, "ip6-forward on";
> +
> + #find outgoing ipv6 interface
> + my ($outip, $outiface) =
> + PVE::Network::SDN::Zones::Plugin::get_local_route_ip('2001:4860:4860::8888');
> +
> + push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> + push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> +
> + push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
> + push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
> + }
> +
> push @iface_config, "arp-accept on" if $ipv4 || $ipv6;
> push @iface_config, "vrf $vrf_iface" if $vrf_iface;
> push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid};
> @@ -333,6 +347,15 @@ sub generate_sdn_config {
> push @iface_config, "bridge_fd 0";
> push @iface_config, "mtu $mtu" if $mtu;
> push @iface_config, "vrf $vrf_iface";
> +
> + if ($enable_forward_v6) {
> + push @iface_config, 'ip6-forward on';
Is there a reason why there's now an ip6-forward statement on the vrfbr
as well? Is this to get router-behavior on the vrfbr as well (which was
previously the case because of the global setting?). Would be good to
have a clearer explanation for why this is needed in the commit message.
> +
> + push @iface_config,
> + "post-up echo 1 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
> + push @iface_config,
> + "post-down echo 0 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
> + }
> push(@{ $config->{$brvrf} }, @iface_config) if !$config->{$brvrf};
> }
>
> @@ -432,4 +455,3 @@ sub vnet_update_hook {
> }
>
> 1;
> -
> diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> index b46d4e7..ea2ef9a 100644
> --- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> @@ -8,6 +8,10 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -23,6 +27,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> index 0d7d174..ee907bf 100644
> --- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> @@ -27,6 +27,10 @@ iface myvnet2
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> index 4bf5ccf..5a378b4 100644
> --- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> @@ -14,6 +14,10 @@ iface myvnet
> mtu 1450
> ip-forward on
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -47,6 +51,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfbr_myzone2
> iface vrfbr_myzone2
> diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> index 7a5d741..d9e63ab 100644
> --- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> @@ -11,6 +11,10 @@ iface myvnet
> mtu 1450
> ip-forward on
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -26,6 +30,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> index b2bdbfe..39c07bf 100644
> --- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> @@ -9,6 +9,10 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -24,6 +28,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> index 3b91f75..13941f4 100644
> --- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> @@ -9,6 +9,10 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -24,6 +28,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
next prev parent reply other threads:[~2026-06-25 9:48 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-19 15:40 [PATCH docs/network/perl-rs v3 0/5] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
2026-06-19 15:40 ` [PATCH network v3 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets Lukas Sichert
2026-06-25 9:47 ` Stefan Hanreich [this message]
2026-06-19 15:40 ` [PATCH network v3 2/5] sdn: simple: " Lukas Sichert
2026-06-25 9:51 ` Stefan Hanreich
2026-06-19 15:40 ` [PATCH perl-rs v3 3/5] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic Lukas Sichert
2026-06-25 9:53 ` Stefan Hanreich
2026-06-19 15:40 ` [PATCH perl-rs v3 4/5] fabrics: bgp: " Lukas Sichert
2026-06-19 15:40 ` [PATCH docs v3 5/5] sdn: drop global ipv6 forwarding workaround from OpenFabric docs Lukas Sichert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f7dbcb5b-0965-4198-9547-a86d662a4f14@proxmox.com \
--to=s.hanreich@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.