From: Hannes Laimer <h.laimer@proxmox.com>
To: Lukas Sichert <l.sichert@proxmox.com>
Cc: pve-devel@lists.proxmox.com
Subject: Re: [PATCH network v4 1/6] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
Date: Mon, 24 Aug 2026 09:23:23 +0200 [thread overview]
Message-ID: <aoveWjD4UYQPLql7@nana.intra.proxmox.com> (raw)
In-Reply-To: <20260727135509.14588-2-l.sichert@proxmox.com>
On 2026-07-27 15:55, Lukas Sichert wrote:
> EVPN zones can route IPv6 subnet traffic through a VNet, an outgoing
> interface, and, for L3VNI setups, a VRF bridge. Until now, this depended
> on global IPv6 forwarding state, which also changes Router Advertisement
> handling for the whole host.
>
> Use the per-interface 'force_forwarding' setting instead. For IPv6
> subnets that need forwarding, generate post-up/post-down commands for
> the VNet interface, the outgoing interface, and the EVPN VRF bridge
> where applicable.
> Update the expected SDN interface output in the zone tests accordingly
>
> Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
> ---
> src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 34 ++++++++++++++++++-
> .../expected_sdn_interfaces | 6 ++++
> .../exitnode_snat/expected_sdn_interfaces | 4 +++
> .../exitnodenullroute/expected_sdn_interfaces | 6 ++++
> .../evpn/ipv4ipv6/expected_sdn_interfaces | 4 +++
> .../zones/evpn/ipv6/expected_sdn_interfaces | 4 +++
> .../evpn/ipv6underlay/expected_sdn_interfaces | 4 +++
> 7 files changed, 61 insertions(+), 1 deletion(-)
>
> diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> index 0e79707..80de5bf 100644
> --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> @@ -302,7 +302,32 @@ sub generate_sdn_config {
> push @iface_config, "mtu $mtu" if $mtu;
> push @iface_config, "alias $alias" if $alias;
> push @iface_config, "ip-forward on" if $enable_forward_v4;
> - push @iface_config, "ip6-forward on" if $enable_forward_v6;
> +
> + if ($enable_forward_v6) {
> + push @iface_config, "ip6-forward on";
> +
> + push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
> + push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
> +
> + if ($is_evpn_gateway) {
> + #find outgoing ipv6 interface
> + my ($outip, $outiface);
> + eval {
> + ($outip, $outiface) =
> + PVE::Network::SDN::Zones::Plugin::get_local_route_ip('2001:4860:4860::8888');
> + };
> + if ($@) {
> + my $msg = "interface for IPv6 forwarding could not be resolved: $@";
> + log_warn($msg);
> + } elsif ($outiface) {
> + push @iface_config,
> + "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> + push @iface_config,
> + "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
our `ifupdown2` is shippes with `ifreload-down-changed=0`, so
`post-down`s never run on changes (except for vxlan and vlan), so just
deleting the subnet, will leave the `force_forwarding=1` on the
`outiface`
sdn apply does run the `post-down` for removed infterfaces, but it also
runs all the `post-up`s again, so this works not because the `post-down`
is not executed on delete, but because the `post-up` re-write the `1`
and with a manual `ifdown`, this can actually break things
we should probably drop the `post-down` here, this is at best a no-op,
and can potentially break things. so this might generally not be the
place to manage a shared uplinks sysctl..
something like we do in pve-common with `disable_ipv6` could be an
alternative, on apply we'd have to check if we still need it on the
uplink interface, then either `=0` or `=1` it
> + }
> + }
> + }
> +
> push @iface_config, "arp-accept on" if $ipv4 || $ipv6;
> push @iface_config, "vrf $vrf_iface" if $vrf_iface;
> push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid};
> @@ -342,6 +367,13 @@ sub generate_sdn_config {
> push @iface_config, "bridge_fd 0";
> push @iface_config, "mtu $mtu" if $mtu;
> push @iface_config, "vrf $vrf_iface";
> +
> + if ($enable_forward_v6) {
> + push @iface_config,
> + "post-up echo 1 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
> + push @iface_config,
> + "post-down echo 0 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
> + }
> push(@{ $config->{$brvrf} }, @iface_config) if !$config->{$brvrf};
emitting `force_forwarding` for the zone `vrfbr_` interfaces is bound to
the first subnet defined on the vnet, if this first one happens to not be
IPv6, `force_forwarding` is missing there
```
auto net1
iface net1
// no v6
..
vrf vrf_aaaaa
auto net2
iface net2
address fc00:2::1/64
..
post-up echo 1 > /proc/sys/net/ipv6/conf/net2/force_forwarding
post-down echo 0 > /proc/sys/net/ipv6/conf/net2/force_forwarding
vrf vrf_aaaaa
...
auto vrfbr_aaaaa
iface vrfbr_aaaaa
bridge-ports vrfvx_aaaaa
bridge_stp off
bridge_fd 0
mtu 1450
vrf vrf_aaaaa
```
> }
>
> diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> index b46d4e7..7b8dc3c 100644
> --- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> @@ -8,6 +8,10 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -23,6 +27,8 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> index 0d7d174..2addde0 100644
> --- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> @@ -27,6 +27,10 @@ iface myvnet2
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> index 4bf5ccf..e406258 100644
> --- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> @@ -14,6 +14,10 @@ iface myvnet
> mtu 1450
> ip-forward on
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -47,6 +51,8 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfbr_myzone2
> iface vrfbr_myzone2
> diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> index 7a5d741..a1fdb2b 100644
> --- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> @@ -11,6 +11,8 @@ iface myvnet
> mtu 1450
> ip-forward on
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -26,6 +28,8 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> index b2bdbfe..4363842 100644
> --- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> @@ -9,6 +9,8 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -24,6 +26,8 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> index 3b91f75..7aaf569 100644
> --- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> @@ -9,6 +9,8 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -24,6 +26,8 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> --
> 2.47.3
>
>
>
>
>
next prev parent reply other threads:[~2026-08-24 7:23 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-27 13:55 [PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
2026-07-27 13:55 ` [PATCH network v4 1/6] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets Lukas Sichert
2026-08-24 7:23 ` Hannes Laimer [this message]
2026-07-27 13:55 ` [PATCH network v4 2/6] sdn: simple: " Lukas Sichert
2026-07-27 13:55 ` [PATCH perl-rs v4 3/6] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic Lukas Sichert
2026-08-24 7:27 ` Hannes Laimer
2026-07-27 13:55 ` [PATCH perl-rs v4 4/6] fabrics: bgp: " Lukas Sichert
2026-07-27 13:55 ` [PATCH manager v4 5/6] ui: sdn: remove IPv6 forwarding hint from fabric edit window Lukas Sichert
2026-07-27 13:55 ` [PATCH docs v4 6/6] sdn: drop global ipv6 forwarding workaround from OpenFabric docs Lukas Sichert
2026-08-24 7:33 ` [PATCH docs/manager/network/perl-rs v4 0/6] sdn: enable force_forwarding for ipv6 forwarding Hannes Laimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aoveWjD4UYQPLql7@nana.intra.proxmox.com \
--to=h.laimer@proxmox.com \
--cc=l.sichert@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox