[PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding

[Lukas Sichert <l.sichert@proxmox.com>]

Gabriel's upstream kernel patch [1] added
net.ipv6.conf.<iface>.force_forwarding. This allows enabling IPv6
forwarding on selected interfaces without requiring
net.ipv6.conf.all.forwarding.

This is useful for SDN setups because all.forwarding has host-wide side
effects. In particular, it disables Router Advertisement processing by
default, which can break SLAAC on unrelated interfaces. SDN only needs
forwarding on the VNet, exit-node, or fabric interfaces that participate
in routed IPv6 traffic.

This series generates ifupdown post-up/post-down commands for those
interfaces so force_forwarding is enabled when the interface is brought
up and reset when it is brought down. /network/interfaces.d/sdn gets
regenerated on SDN Apply. This means that removing a VNet also removes
the corresponding 'post-down' commands configured to the interface of
the VNet. Therefore it cannot happen, that deleting one VNet in the GUI
removes force_forwarding on the outgoing interfaces, which might be used
by other VNets as well. The tests are adjusted for the generated
/etc/network/interfaces.d/sdn output. Also the series rewrites the
documentation to reflect the updated behaviour and removes the UI warning
to enable 'all.forwarding'.


[1] lkml.org/lkml/2025/7/7/577

changes from v3 to v4 (thanks @Stefan):
-wrap resolving outgoing interface in eval block
-remove unnecessary 'ip6-forward' for vrfbr interface
-Drop the fabric edit GUI hint that told users to enable
net.ipv6.conf.all.forwarding
-remove whitespace formatting changes

changes from v2 to v3 (thanks @Gabriel):
-Move the IPv6 force_forwarding post-up/post-down commands out of the
subnet loop, so they are generated only once for the VNet instead of
once per subnet.
-Enable ip6-forward and force_forwarding on EVPN L3VNI VRF bridge
interfaces, fixing IPv6 forwarding when traffic exits through another
node.

changes from v1 to v2 (thanks @Gabriel, @Hannes):
-add force_forwarding also to bgp fabrics
-explicitly mention the force_forwarding flag in the documentation
-add a reference link to the sysctl documentation
-mention bgp as a fabric with ipv6 support


network:

Lukas Sichert (2):
  sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
  sdn: simple: enable force_forwarding for ipv6 forwarding to subnets

 src/PVE/Network/SDN/Zones/EvpnPlugin.pm       | 34 ++++++++++++++++++-
 src/PVE/Network/SDN/Zones/SimplePlugin.pm     | 25 +++++++++++++-
 .../expected_sdn_interfaces                   |  6 ++++
 .../exitnode_snat/expected_sdn_interfaces     |  4 +++
 .../exitnodenullroute/expected_sdn_interfaces |  6 ++++
 .../evpn/ipv4ipv6/expected_sdn_interfaces     |  4 +++
 .../zones/evpn/ipv6/expected_sdn_interfaces   |  4 +++
 .../evpn/ipv6underlay/expected_sdn_interfaces |  4 +++
 .../simple/ipv4v6/expected_sdn_interfaces     |  4 +++
 .../simple/ipv6snat/expected_sdn_interfaces   |  4 +++
 10 files changed, 93 insertions(+), 2 deletions(-)


perl-rs:

Lukas Sichert (2):
  fabrics: openfabric: enable force_forwarding for ipv6 transit traffic
  fabrics: bgp: enable force_forwarding for ipv6 transit traffic

 pve-rs/src/bindings/sdn/fabrics.rs | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)


manager:

Lukas Sichert (1):
  ui: sdn: remove IPv6 forwarding hint from fabric edit window

 www/manager6/sdn/fabrics/FabricEdit.js | 59 +++++++++-----------------
 1 file changed, 20 insertions(+), 39 deletions(-)


docs:

Lukas Sichert (1):
  sdn: drop global ipv6 forwarding workaround from OpenFabric docs

 pvesdn.adoc | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)


Summary over all repositories:
  13 files changed, 136 insertions(+), 57 deletions(-)

-- 
Generated by murpp 0.12.0