From: Lukas Sichert <l.sichert@proxmox.com>
To: pve-devel@lists.proxmox.com
Cc: Lukas Sichert <l.sichert@proxmox.com>
Subject: [PATCH network v3 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
Date: Fri, 19 Jun 2026 17:40:01 +0200 [thread overview]
Message-ID: <20260619154017.167720-2-l.sichert@proxmox.com> (raw)
In-Reply-To: <20260619154017.167720-1-l.sichert@proxmox.com>
EVPN zones can route IPv6 subnet traffic through a VNet, an outgoing
interface, and, for L3VNI setups, a VRF bridge. Until now, this depended
on global IPv6 forwarding state, which also changes Router Advertisement
handling for the whole host.
Use the per-interface 'force_forwarding' setting instead. For IPv6
subnets that need forwarding, generate post-up/post-down commands for
the VNet interface, the outgoing interface, and the EVPN L3VNI VRF bridge
where applicable.
Update the expected SDN interface output in the zone tests accordingly
Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 28 +++++++++++++++++--
.../expected_sdn_interfaces | 7 +++++
.../exitnode_snat/expected_sdn_interfaces | 4 +++
.../exitnodenullroute/expected_sdn_interfaces | 7 +++++
.../evpn/ipv4ipv6/expected_sdn_interfaces | 7 +++++
.../zones/evpn/ipv6/expected_sdn_interfaces | 7 +++++
.../evpn/ipv6underlay/expected_sdn_interfaces | 7 +++++
7 files changed, 64 insertions(+), 3 deletions(-)
diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index dfbd7e9..bdbb219 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -238,6 +238,7 @@ sub generate_sdn_config {
my $ipv6 = undef;
my $enable_forward_v4 = undef;
my $enable_forward_v6 = undef;
+
my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
foreach my $subnetid (sort keys %{$subnets}) {
my $subnet = $subnets->{$subnetid};
@@ -267,7 +268,6 @@ sub generate_sdn_config {
}
if ($subnet->{snat}) {
-
#find outgoing interface
my ($outip, $outiface) =
PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
@@ -293,7 +293,21 @@ sub generate_sdn_config {
push @iface_config, "mtu $mtu" if $mtu;
push @iface_config, "alias $alias" if $alias;
push @iface_config, "ip-forward on" if $enable_forward_v4;
- push @iface_config, "ip6-forward on" if $enable_forward_v6;
+
+ if ($enable_forward_v6) {
+ push @iface_config, "ip6-forward on";
+
+ #find outgoing ipv6 interface
+ my ($outip, $outiface) =
+ PVE::Network::SDN::Zones::Plugin::get_local_route_ip('2001:4860:4860::8888');
+
+ push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
+ push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
+
+ push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
+ push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
+ }
+
push @iface_config, "arp-accept on" if $ipv4 || $ipv6;
push @iface_config, "vrf $vrf_iface" if $vrf_iface;
push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid};
@@ -333,6 +347,15 @@ sub generate_sdn_config {
push @iface_config, "bridge_fd 0";
push @iface_config, "mtu $mtu" if $mtu;
push @iface_config, "vrf $vrf_iface";
+
+ if ($enable_forward_v6) {
+ push @iface_config, 'ip6-forward on';
+
+ push @iface_config,
+ "post-up echo 1 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
+ push @iface_config,
+ "post-down echo 0 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
+ }
push(@{ $config->{$brvrf} }, @iface_config) if !$config->{$brvrf};
}
@@ -432,4 +455,3 @@ sub vnet_update_hook {
}
1;
-
diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
index b46d4e7..ea2ef9a 100644
--- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
@@ -8,6 +8,10 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -23,6 +27,9 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
index 0d7d174..ee907bf 100644
--- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
@@ -27,6 +27,10 @@ iface myvnet2
bridge_fd 0
mtu 1450
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
arp-accept on
vrf vrf_myzone
diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
index 4bf5ccf..5a378b4 100644
--- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
@@ -14,6 +14,10 @@ iface myvnet
mtu 1450
ip-forward on
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -47,6 +51,9 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfbr_myzone2
iface vrfbr_myzone2
diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
index 7a5d741..d9e63ab 100644
--- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
@@ -11,6 +11,10 @@ iface myvnet
mtu 1450
ip-forward on
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -26,6 +30,9 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
index b2bdbfe..39c07bf 100644
--- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
@@ -9,6 +9,10 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -24,6 +28,9 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
index 3b91f75..13941f4 100644
--- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
@@ -9,6 +9,10 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
+ post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
arp-accept on
vrf vrf_myzone
@@ -24,6 +28,9 @@ iface vrfbr_myzone
bridge_fd 0
mtu 1450
vrf vrf_myzone
+ ip6-forward on
+ post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
+ post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
auto vrfvx_myzone
iface vrfvx_myzone
--
2.47.3
next prev parent reply other threads:[~2026-06-19 15:41 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-19 15:40 [PATCH docs/network/perl-rs v3 0/5] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
2026-06-19 15:40 ` Lukas Sichert [this message]
2026-06-19 15:40 ` [PATCH network v3 2/5] sdn: simple: enable force_forwarding for ipv6 forwarding to subnets Lukas Sichert
2026-06-19 15:40 ` [PATCH perl-rs v3 3/5] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic Lukas Sichert
2026-06-19 15:40 ` [PATCH perl-rs v3 4/5] fabrics: bgp: " Lukas Sichert
2026-06-19 15:40 ` [PATCH docs v3 5/5] sdn: drop global ipv6 forwarding workaround from OpenFabric docs Lukas Sichert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260619154017.167720-2-l.sichert@proxmox.com \
--to=l.sichert@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox