From: Lukas Sichert <l.sichert@proxmox.com>
To: pve-devel@lists.proxmox.com
Cc: Lukas Sichert <l.sichert@proxmox.com>
Subject: [PATCH network v5 03/10] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
Date: Wed, 4 Nov 2026 15:55:04 +0100 [thread overview]
Message-ID: <20261104145513.21471-4-l.sichert@proxmox.com> (raw)
In-Reply-To: <20261104145513.21471-1-l.sichert@proxmox.com>
EVPN zones can route IPv6 subnet traffic through a VNet, an outgoing
interface and a VRF bridge. Until now, this depended on global IPv6
forwarding state, which also changes Router Advertisement handling for
the whole host.
Enable 'force_forwarding' explicitly on the Subnet and VRF bridge using
the 'ip6-force-forward' ifupdown2 flag.
Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 8 +++++++-
.../exitnode_local_routing_ipv6/expected_sdn_interfaces | 2 ++
src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces | 2 ++
.../zones/evpn/exitnodenullroute/expected_sdn_interfaces | 2 ++
src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces | 2 ++
src/test/zones/evpn/ipv6/expected_sdn_interfaces | 2 ++
src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces | 2 ++
7 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index 8a45c51..1bec8c2 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -308,7 +308,12 @@ sub generate_sdn_config {
push @iface_config, "mtu $mtu" if $mtu;
push @iface_config, "alias $alias" if $alias;
push @iface_config, "ip-forward on" if $enable_forward_v4;
- push @iface_config, "ip6-forward on" if $enable_forward_v6;
+
+ if ($enable_forward_v6) {
+ push @iface_config, "ip6-forward on";
+ push @iface_config, "ip6-force-forward on";
+ }
+
push @iface_config, "arp-accept on" if $ipv4 || $ipv6;
push @iface_config, "vrf $vrf_iface" if $vrf_iface;
push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid};
@@ -354,6 +359,7 @@ sub generate_sdn_config {
push @forward_opts, 'ip-forward on' if $enable_forward_v4;
if ($enable_forward_v6) {
push @forward_opts, 'ip6-forward on';
+ push @forward_opts, 'ip6-force-forward on';
}
for my $opt (@forward_opts) {
my $opt_absent = !grep { $_ eq $opt } @{ $config->{$brvrf} };
diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
index 02b52c1..97e0e06 100644
--- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
@@ -8,6 +8,7 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ ip6-force-forward on
arp-accept on
vrf vrf_myzone
@@ -24,6 +25,7 @@ iface vrfbr_myzone
mtu 1450
vrf vrf_myzone
ip6-forward on
+ ip6-force-forward on
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
index 522a54e..ce7f86f 100644
--- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
@@ -27,6 +27,7 @@ iface myvnet2
bridge_fd 0
mtu 1450
ip6-forward on
+ ip6-force-forward on
arp-accept on
vrf vrf_myzone
@@ -44,6 +45,7 @@ iface vrfbr_myzone
vrf vrf_myzone
ip-forward on
ip6-forward on
+ ip6-force-forward on
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
index 6878397..88bb214 100644
--- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
+++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
@@ -14,6 +14,7 @@ iface myvnet
mtu 1450
ip-forward on
ip6-forward on
+ ip6-force-forward on
arp-accept on
vrf vrf_myzone
@@ -49,6 +50,7 @@ iface vrfbr_myzone
vrf vrf_myzone
ip-forward on
ip6-forward on
+ ip6-force-forward on
auto vrfbr_myzone2
iface vrfbr_myzone2
diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
index 0bde7a1..45d8e63 100644
--- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
@@ -11,6 +11,7 @@ iface myvnet
mtu 1450
ip-forward on
ip6-forward on
+ ip6-force-forward on
arp-accept on
vrf vrf_myzone
@@ -28,6 +29,7 @@ iface vrfbr_myzone
vrf vrf_myzone
ip-forward on
ip6-forward on
+ ip6-force-forward on
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
index 98793a1..882dd72 100644
--- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
@@ -9,6 +9,7 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ ip6-force-forward on
arp-accept on
vrf vrf_myzone
@@ -25,6 +26,7 @@ iface vrfbr_myzone
mtu 1450
vrf vrf_myzone
ip6-forward on
+ ip6-force-forward on
auto vrfvx_myzone
iface vrfvx_myzone
diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
index 62f05df..98cd43f 100644
--- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
+++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
@@ -9,6 +9,7 @@ iface myvnet
bridge_fd 0
mtu 1450
ip6-forward on
+ ip6-force-forward on
arp-accept on
vrf vrf_myzone
@@ -25,6 +26,7 @@ iface vrfbr_myzone
mtu 1450
vrf vrf_myzone
ip6-forward on
+ ip6-force-forward on
auto vrfvx_myzone
iface vrfvx_myzone
--
2.47.3
next prev parent reply other threads:[~2026-11-04 14:55 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-04 14:55 [PATCH many v5 00/10] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
2026-11-04 14:55 ` [PATCH ifupdown2 v5 01/10] d/patches: add ipv6 force_forwarding for bridges Lukas Sichert
2026-11-04 14:55 ` [PATCH network v5 02/10] sdn: evpn: enable ip forwarding on the vrf bridge interface Lukas Sichert
2026-11-04 14:55 ` Lukas Sichert [this message]
2026-11-04 14:55 ` [PATCH network v5 04/10] sdn: simple: enable force_forwarding for ipv6 forwarding to subnets Lukas Sichert
2026-11-04 14:55 ` [PATCH network v5 05/10] tests: sdn: update fabric expectations for explicit ipv6 forwarding Lukas Sichert
2026-11-04 14:55 ` [PATCH perl-rs v5 06/10] openfabric: set ip6-forward explicitly Lukas Sichert
2026-11-04 14:55 ` [PATCH perl-rs v5 07/10] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic Lukas Sichert
2026-11-04 14:55 ` [PATCH perl-rs v5 08/10] fabrics: bgp: " Lukas Sichert
2026-11-04 14:55 ` [PATCH manager v5 09/10] ui: sdn: remove IPv6 forwarding hint from fabric edit window Lukas Sichert
2026-11-04 14:55 ` [PATCH docs v5 10/10] sdn: drop global ipv6 forwarding workaround from docs Lukas Sichert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261104145513.21471-4-l.sichert@proxmox.com \
--to=l.sichert@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox