Re: [RFC manager/network 0/3] fix #5066: make generated snat rules flushable

[Stefan Hanreich <s.hanreich@proxmox.com>]

could you rebase this and resend?

On 6/5/26 1:48 PM, Lukas Sichert wrote:
> When creating a subnet with SNAT enabled and applying the changes, then
> afterwards disabling SNAT and applying the changes again, the iptables
> POSTROUTING rule still persists. This is because ifreload -a only
> executes (post/pre-)down hooks when an interface is removed from
> /etc/network/interfaces, while the (post/pre-)up hooks are always
> executed [1]. As a result, the SNAT rule is not removed by 'ifreload -a' and
> only a restart or 'ifdown' will remove it.
> 
> This series moves generated SDN SNAT rules into a dedicated
> 'PROXMOX-SDN' chain in the iptables nat table and adds a jump from
> POSTROUTING to that chain. This keeps the generated rules separate from
> custom rules added by users or other components.
> 
> The dedicated chain can then be flushed during network reload, removing
> stale SDN SNAT rules without touching unrelated POSTROUTING rules.
> 
> As this changes the generated /etc/network/interfaces.d/sdn output, the
> expected test output is adjusted accordingly.
> 
> This series applies on top of
> https://lore.proxmox.com/all/20260603142921.91174-1-l.sichert@proxmox.com/
> 
> [1] manpages.debian.org/testing/ifupdown2/ifreload.8.en.html
> 
> 
> network:
> 
> Lukas Sichert (2):
>   fix #5066: snat: push evpn snat rules into separate iptables chain
>   fix #5066: snat: push simplezone snat rules into separate iptables
>     chain
> 
>  src/PVE/Network/SDN/Zones/EvpnPlugin.pm        | 15 +++++++++++++--
>  src/PVE/Network/SDN/Zones/SimplePlugin.pm      | 18 +++++++++++++++---
>  .../evpn/exitnode_snat/expected_sdn_interfaces | 16 ++++++++++++----
>  .../simple/ipv4snat/expected_sdn_interfaces    |  8 ++++++--
>  .../simple/ipv6snat/expected_sdn_interfaces    |  8 ++++++--
>  5 files changed, 52 insertions(+), 13 deletions(-)
> 
> 
> manager:
> 
> Lukas Sichert (1):
>   fix #5066: reload networking: flush PROXMOX-SDN iptables chain at
>     reload
> 
>  .codex              | 0
>  PVE/API2/Network.pm | 3 +++
>  2 files changed, 3 insertions(+)
>  create mode 100644 .codex
> 
> 
> Summary over all repositories:
>   7 files changed, 55 insertions(+), 13 deletions(-)
>