From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 857E61FF0BC for ; Thu, 29 Oct 2026 16:42:28 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 9DA332144F; Thu, 29 Oct 2026 16:42:24 +0100 (CET) From: Hannes Laimer To: pve-devel@lists.proxmox.com Subject: [PATCH pve-network v5 5/9] sdn: evpn: derive IP version from CIDR for gateway-less subnets Date: Thu, 29 Oct 2026 16:41:44 +0100 Message-ID: <20261029154148.2882594-6-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261029154148.2882594-1-h.laimer@proxmox.com> References: <20261029154148.2882594-1-h.laimer@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793288520586 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.370 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 7CVN3VTMRKIMMDNNRWDDFU6BGAWSF6Z6 X-Message-ID-Hash: 7CVN3VTMRKIMMDNNRWDDFU6BGAWSF6Z6 X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The IP version was derived from the gateway alone, falling back to IPv4 when no gateway was set. So on exit nodes an IPv6 subnet with SNAT but no gateway got its NAT rules for iptables, which rejects the IPv6 source. Fall back to the subnet CIDR. Signed-off-by: Hannes Laimer --- Notes: v3: - derive the IP version from the CIDR for gateway-less subnets src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm index 0e79707c3746..c1d5536e09c0 100644 --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm @@ -253,7 +253,12 @@ sub generate_sdn_config { my $iptables = undef; my $checkrouteip = undef; - my $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4; + my $ipversion = 4; + if ($gateway) { + $ipversion = Net::IP::ip_is_ipv6($gateway) ? 6 : 4; + } elsif ($subnet->{network}) { + $ipversion = Net::IP::ip_is_ipv6($subnet->{network}) ? 6 : 4; + } if ($ipversion == 6) { $ipv6 = 1; -- 2.47.3