[RFC manager/network 0/3] fix #5066: make generated snat rules flushable

[Lukas Sichert <l.sichert@proxmox.com>]

When creating a subnet with SNAT enabled and applying the changes, then
afterwards disabling SNAT and applying the changes again, the iptables
POSTROUTING rule still persists. This is because ifreload -a only
executes (post/pre-)down hooks when an interface is removed from
/etc/network/interfaces, while the (post/pre-)up hooks are always
executed [1]. As a result, the SNAT rule is not removed by 'ifreload -a' and
only a restart or 'ifdown' will remove it.

This series moves generated SDN SNAT rules into a dedicated
'PROXMOX-SDN' chain in the iptables nat table and adds a jump from
POSTROUTING to that chain. This keeps the generated rules separate from
custom rules added by users or other components.

The dedicated chain can then be flushed during network reload, removing
stale SDN SNAT rules without touching unrelated POSTROUTING rules.

As this changes the generated /etc/network/interfaces.d/sdn output, the
expected test output is adjusted accordingly.

This series applies on top of
https://lore.proxmox.com/all/20260603142921.91174-1-l.sichert@proxmox.com/

[1] manpages.debian.org/testing/ifupdown2/ifreload.8.en.html


network:

Lukas Sichert (2):
  fix #5066: snat: push evpn snat rules into separate iptables chain
  fix #5066: snat: push simplezone snat rules into separate iptables
    chain

 src/PVE/Network/SDN/Zones/EvpnPlugin.pm        | 15 +++++++++++++--
 src/PVE/Network/SDN/Zones/SimplePlugin.pm      | 18 +++++++++++++++---
 .../evpn/exitnode_snat/expected_sdn_interfaces | 16 ++++++++++++----
 .../simple/ipv4snat/expected_sdn_interfaces    |  8 ++++++--
 .../simple/ipv6snat/expected_sdn_interfaces    |  8 ++++++--
 5 files changed, 52 insertions(+), 13 deletions(-)


manager:

Lukas Sichert (1):
  fix #5066: reload networking: flush PROXMOX-SDN iptables chain at
    reload

 .codex              | 0
 PVE/API2/Network.pm | 3 +++
 2 files changed, 3 insertions(+)
 create mode 100644 .codex


Summary over all repositories:
  7 files changed, 55 insertions(+), 13 deletions(-)

-- 
Generated by murpp 0.12.0