From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 242A41FF0C0 for ; Wed, 04 Nov 2026 15:55:26 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id C73E3213DD; Wed, 04 Nov 2026 15:55:23 +0100 (CET) From: Lukas Sichert To: pve-devel@lists.proxmox.com Subject: [PATCH many v5 00/10] sdn: enable force_forwarding for ipv6 forwarding Date: Wed, 4 Nov 2026 15:55:01 +0100 Message-ID: <20261104145513.21471-1-l.sichert@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793804119255 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.543 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_SHORT 0.001 Use of a URL Shortener for very short URL RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: MIRNFGJPT6XHM454MWTDETUQDVVQGQPJ X-Message-ID-Hash: MIRNFGJPT6XHM454MWTDETUQDVVQGQPJ X-MailFrom: l.sichert@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Lukas Sichert X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Gabriel's upstream kernel patch [1] added net.ipv6.conf..force_forwarding. This allows enabling IPv6 forwarding on selected interfaces without requiring net.ipv6.conf.all.forwarding. This is useful for SDN setups because all.forwarding has host-wide side effects. In particular, it disables Router Advertisement processing by default, which can break SLAAC on unrelated interfaces. This series introduces the force_forwarding kernel flag to ifupdown2, where it mimics the activation behaviour of the classic forwarding flag. This means force_forwarding is only turned off for a bridge if all of the following hold: - it has no upper interfaces, such as an SVI or VLAN slave interface - it has no address configured - its address method is set and it is not auto or dhcp This is consistent with current behaviour and important for the bridges created manually as their flags are not set by the ifupdown2 configs generated in pve-network. This also means for a lot of bridges in the SDN stack force_forwarding is enabled by default, still the ip6-force-forward stanzas will be written to interfaces.d/sdn to activate it explicitly. The series also adds missing stanzas for ipv4 and ipv6 forwarding, where the enabling came from ifupdown2 default behaviour only. The tests are adjusted for the generated /etc/network/interfaces.d/sdn output. Also the series rewrites the documentation to reflect the updated behaviour and removes the UI warning to enable 'all.forwarding'. Note: ifupdown2 needs to be applied first, then perl-rs, then network (its tests render fabrics via perl-rs). Needs kernel >= 6.17, older kernels ignore 'ip6-force-forward' with a warning. [1] lkml.org/lkml/2025/7/7/577 Changes from v4 to v5 (thanks @Hannes): -add flags and automated behaviour for activation of force_forwarding in ifupdown2 -remove the post-up/post down stanzas and use the ifupdown2 flags to explicitly enable forwarding instead changes from v3 to v4 (thanks @Stefan): -wrap resolving outgoing interface in eval block -remove unnecessary 'ip6-forward' for vrfbr interface -Drop the fabric edit GUI hint that told users to enable net.ipv6.conf.all.forwarding -remove whitespace formatting changes changes from v2 to v3 (thanks @Gabriel): -Move the IPv6 force_forwarding post-up/post-down commands out of the subnet loop, so they are generated only once for the VNet instead of once per subnet. -Enable ip6-forward and force_forwarding on EVPN L3VNI VRF bridge interfaces, fixing IPv6 forwarding when traffic exits through another node. changes from v1 to v2 (thanks @Gabriel, @Hannes): -add force_forwarding also to bgp fabrics -explicitly mention the force_forwarding flag in the documentation -add a reference link to the sysctl documentation -mention bgp as a fabric with ipv6 support ifupdown2: Lukas Sichert (1): d/patches: add ipv6 force_forwarding for bridges ...set-ipv6-force_forwarding-on-bridges.patch | 197 ++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 198 insertions(+) create mode 100644 debian/patches/pve/0017-addons-address-set-ipv6-force_forwarding-on-bridges.patch network: Lukas Sichert (4): sdn: evpn: enable ip forwarding on the vrf bridge interface sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets sdn: simple: enable force_forwarding for ipv6 forwarding to subnets tests: sdn: update fabric expectations for explicit ipv6 forwarding src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 18 +++++++++++++++++- src/PVE/Network/SDN/Zones/SimplePlugin.pm | 6 +++++- .../advertise_subnets/expected_sdn_interfaces | 1 + .../evpn/auto_mode/expected_sdn_interfaces | 1 + .../evpn/bgp_ebgp/expected_sdn_interfaces | 1 + .../bgp_ebgp_multihop/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../evpn/bgp_fabric/expected_sdn_interfaces | 3 +++ .../evpn/bgp_loopback/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../combined_bgp_isis/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../zones/evpn/ebgp/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 2 ++ .../evpn/ebgp_loopback/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 2 ++ .../evpn/exitnode/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 3 +++ .../exitnode_primary/expected_sdn_interfaces | 1 + .../evpn/exitnode_snat/expected_sdn_interfaces | 4 ++++ .../exitnodenullroute/expected_sdn_interfaces | 5 +++++ .../frr_local_merge/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../zones/evpn/ipv4/expected_sdn_interfaces | 1 + .../evpn/ipv4ipv6/expected_sdn_interfaces | 4 ++++ .../zones/evpn/ipv6/expected_sdn_interfaces | 3 +++ .../evpn/ipv6underlay/expected_sdn_interfaces | 3 +++ .../zones/evpn/isis/expected_sdn_interfaces | 1 + .../evpn/isis_loopback/expected_sdn_interfaces | 1 + .../multipath_relax/expected_sdn_interfaces | 1 + .../evpn/multiplezones/expected_sdn_interfaces | 2 ++ .../openfabric_fabric/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 3 +++ .../expected_sdn_interfaces | 7 +++++++ .../evpn/ospf_fabric/expected_sdn_interfaces | 1 + .../evpn/routemap/expected_sdn_interfaces | 1 + .../routemap_exit_node/expected_sdn_interfaces | 1 + .../expected_sdn_interfaces | 1 + .../evpn/rt_import/expected_sdn_interfaces | 1 + .../evpn/vxlanport/expected_sdn_interfaces | 1 + .../simple/ipv4v6/expected_sdn_interfaces | 1 + .../simple/ipv6snat/expected_sdn_interfaces | 1 + 47 files changed, 96 insertions(+), 2 deletions(-) perl-rs: Lukas Sichert (3): openfabric: set ip6-forward explicitly fabrics: openfabric: enable force_forwarding for ipv6 transit traffic fabrics: bgp: enable force_forwarding for ipv6 transit traffic pve-rs/src/bindings/sdn/fabrics.rs | 5 +++++ 1 file changed, 5 insertions(+) manager: Lukas Sichert (1): ui: sdn: remove IPv6 forwarding hint from fabric edit window www/manager6/sdn/fabrics/FabricEdit.js | 59 +++++++++----------------- 1 file changed, 20 insertions(+), 39 deletions(-) docs: Lukas Sichert (1): sdn: drop global ipv6 forwarding workaround from docs pvesdn.adoc | 27 +++++++-------------------- 1 file changed, 7 insertions(+), 20 deletions(-) Summary over all repositories: 52 files changed, 326 insertions(+), 61 deletions(-) -- Generated by murpp 0.12.0