Re: [PATCH access-control/cluster/manager/network/proxmox{-ve-rs,-perl-rs} v5 00/46] Add support for route maps / prefix lists to SDN

["Lukas Sichert" <l.sichert@proxmox.com>]

On 2026-05-05 17:36, Stefan Hanreich <s.hanreich@proxmox.com> wrote:

> ## Introduction
>
> This patch adds support for managing route maps and prefix lists to the SDN
> stack. With this patch series, route maps can be applied to the BGP and EVPN
> controller for incoming / outgoing route filtering. Additionally, prefix lists
> can be used to filter routes that should be installed by a fabric into the
> kernel routing table, overriding the default behavior of only installing routes
> from the configured IP prefix. There are currently some other features in
> development that would make use of route maps as well, namely:
>
> * VRF route leaking
> * Route Redistribution for Fabrics

On my host there are two SimpleZones configured. In the first SimpleZone
there is a VM, which shall be called tm1 from now on. In the VNet there
is a cluster consisting of the nodes cl1, cl2 and cl3. All the nodes can
reach each other. On the cluster I configured an EVPN with an OpenFabric
underlay, configured cl1 as the exit node and enabled 'Advertise
Subnets'. In the EVPN Zone I created the 10.0.10.0/24 subnet.

Then on cl1 I added a bgp controller with EBGP and 'ebgp-multihop' set
to 10 and the ip of tm1 set as peer. On tm1 I also added a bgp
controller with the same configuration, but with cl1 as peer and a
different ASN. In both cases I ran into a problem where 'delete' was not
defined in the schema, but this could be resolved by applying [1].
EBGP multihop was enabled here, because the traffic between the
SimpleZones was routed via my host, which did not have a BGP controller
configured.

I could then verify, that the 10.0.10.0/24 subnet was correctly
adveritsed from cl1 to tm1. After configuring prefix lists and
route-maps on both cl1 and tm1 I could verify that both incoming and
outgoing route-maps work, as the 10.0.10.0/24 was not advertised
anymore.

Here I ran into a problem though. I configured a prefix list with
Prefix: 10.0.10.0/22
Prefix<=:21
This is of course wrong, but it is not checked, so applying it is
possible. Here maybe a check in the frontend would be useful.
After applying I got a warning and even after correcting the prefix list
the warning did not go away. After deleting and reconfiguring the list
it worked again, but apparently, when adding Prefix<=:, it is only
possible to alter the value, not delete it. Deleting will just be
ignored.

Also one other small nit:
In the beginning I was very confused by the naming in the prefix list
configuration box.
'Permit' and 'Deny' standing for match all and match everything except
follows the frr config naming scheme, but for me it seemed like the
prefix list directly would block these prefixes. Maybe putting (Match
all) after 'Permit' would make it clearer.
Also Prefix<= is a bit confusing as this really stands for prefix length
not prefix value. Maybe CIDR<= or Prefix Length<= could be used here.


Tested-by: Lukas Sichert <l.sichert@proxmox.com>


[1] lore.proxmox.com/pve-devel/20260506102301.220990-1-g.goller@proxmox.com/T/#u