From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: Re: [PATCH network v3 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets
Date: Thu, 25 Jun 2026 11:47:58 +0200 [thread overview]
Message-ID: <f7dbcb5b-0965-4198-9547-a86d662a4f14@proxmox.com> (raw)
In-Reply-To: <20260619154017.167720-2-l.sichert@proxmox.com>
On 6/19/26 5:41 PM, Lukas Sichert wrote:
> EVPN zones can route IPv6 subnet traffic through a VNet, an outgoing
> interface, and, for L3VNI setups, a VRF bridge. Until now, this depended
> on global IPv6 forwarding state, which also changes Router Advertisement
> handling for the whole host.
>
> Use the per-interface 'force_forwarding' setting instead. For IPv6
> subnets that need forwarding, generate post-up/post-down commands for
> the VNet interface, the outgoing interface, and the EVPN L3VNI VRF bridge
> where applicable.
> Update the expected SDN interface output in the zone tests accordingly
>
> Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
> ---
> src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 28 +++++++++++++++++--
> .../expected_sdn_interfaces | 7 +++++
> .../exitnode_snat/expected_sdn_interfaces | 4 +++
> .../exitnodenullroute/expected_sdn_interfaces | 7 +++++
> .../evpn/ipv4ipv6/expected_sdn_interfaces | 7 +++++
> .../zones/evpn/ipv6/expected_sdn_interfaces | 7 +++++
> .../evpn/ipv6underlay/expected_sdn_interfaces | 7 +++++
> 7 files changed, 64 insertions(+), 3 deletions(-)
>
> diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> index dfbd7e9..bdbb219 100644
> --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> @@ -238,6 +238,7 @@ sub generate_sdn_config {
> my $ipv6 = undef;
> my $enable_forward_v4 = undef;
> my $enable_forward_v6 = undef;
> +
such whitespace formatting changes are usually better sent upfront,
since they're unrelated to the actual patch.
> my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
> foreach my $subnetid (sort keys %{$subnets}) {
> my $subnet = $subnets->{$subnetid};
> @@ -267,7 +268,6 @@ sub generate_sdn_config {
> }
>
> if ($subnet->{snat}) {
> -
here as well
> #find outgoing interface
> my ($outip, $outiface) =
> PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
> @@ -293,7 +293,21 @@ sub generate_sdn_config {
> push @iface_config, "mtu $mtu" if $mtu;
> push @iface_config, "alias $alias" if $alias;
> push @iface_config, "ip-forward on" if $enable_forward_v4;
> - push @iface_config, "ip6-forward on" if $enable_forward_v6;
> +
> + if ($enable_forward_v6) {
> + push @iface_config, "ip6-forward on";
> +
> + #find outgoing ipv6 interface
> + my ($outip, $outiface) =
> + PVE::Network::SDN::Zones::Plugin::get_local_route_ip('2001:4860:4860::8888');
> +
> + push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> + push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> +
> + push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
> + push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnetid/force_forwarding";
> + }
> +
> push @iface_config, "arp-accept on" if $ipv4 || $ipv6;
> push @iface_config, "vrf $vrf_iface" if $vrf_iface;
> push(@{ $config->{$vnetid} }, @iface_config) if !$config->{$vnetid};
> @@ -333,6 +347,15 @@ sub generate_sdn_config {
> push @iface_config, "bridge_fd 0";
> push @iface_config, "mtu $mtu" if $mtu;
> push @iface_config, "vrf $vrf_iface";
> +
> + if ($enable_forward_v6) {
> + push @iface_config, 'ip6-forward on';
Is there a reason why there's now an ip6-forward statement on the vrfbr
as well? Is this to get router-behavior on the vrfbr as well (which was
previously the case because of the global setting?). Would be good to
have a clearer explanation for why this is needed in the commit message.
> +
> + push @iface_config,
> + "post-up echo 1 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
> + push @iface_config,
> + "post-down echo 0 > /proc/sys/net/ipv6/conf/$brvrf/force_forwarding";
> + }
> push(@{ $config->{$brvrf} }, @iface_config) if !$config->{$brvrf};
> }
>
> @@ -432,4 +455,3 @@ sub vnet_update_hook {
> }
>
> 1;
> -
> diff --git a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> index b46d4e7..ea2ef9a 100644
> --- a/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnode_local_routing_ipv6/expected_sdn_interfaces
> @@ -8,6 +8,10 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -23,6 +27,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> index 0d7d174..ee907bf 100644
> --- a/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnode_snat/expected_sdn_interfaces
> @@ -27,6 +27,10 @@ iface myvnet2
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet2/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> diff --git a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> index 4bf5ccf..5a378b4 100644
> --- a/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/exitnodenullroute/expected_sdn_interfaces
> @@ -14,6 +14,10 @@ iface myvnet
> mtu 1450
> ip-forward on
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -47,6 +51,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfbr_myzone2
> iface vrfbr_myzone2
> diff --git a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> index 7a5d741..d9e63ab 100644
> --- a/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv4ipv6/expected_sdn_interfaces
> @@ -11,6 +11,10 @@ iface myvnet
> mtu 1450
> ip-forward on
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -26,6 +30,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/ipv6/expected_sdn_interfaces b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> index b2bdbfe..39c07bf 100644
> --- a/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv6/expected_sdn_interfaces
> @@ -9,6 +9,10 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -24,6 +28,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
> diff --git a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> index 3b91f75..13941f4 100644
> --- a/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> +++ b/src/test/zones/evpn/ipv6underlay/expected_sdn_interfaces
> @@ -9,6 +9,10 @@ iface myvnet
> bridge_fd 0
> mtu 1450
> ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vmbr0/force_forwarding
> + post-up echo 1 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/myvnet/force_forwarding
> arp-accept on
> vrf vrf_myzone
>
> @@ -24,6 +28,9 @@ iface vrfbr_myzone
> bridge_fd 0
> mtu 1450
> vrf vrf_myzone
> + ip6-forward on
> + post-up echo 1 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
> + post-down echo 0 > /proc/sys/net/ipv6/conf/vrfbr_myzone/force_forwarding
>
> auto vrfvx_myzone
> iface vrfvx_myzone
next prev parent reply other threads:[~2026-06-25 9:48 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-19 15:40 [PATCH docs/network/perl-rs v3 0/5] sdn: enable force_forwarding for ipv6 forwarding Lukas Sichert
2026-06-19 15:40 ` [PATCH network v3 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets Lukas Sichert
2026-06-25 9:47 ` Stefan Hanreich [this message]
2026-06-19 15:40 ` [PATCH network v3 2/5] sdn: simple: " Lukas Sichert
2026-06-25 9:51 ` Stefan Hanreich
2026-06-19 15:40 ` [PATCH perl-rs v3 3/5] fabrics: openfabric: enable force_forwarding for ipv6 transit traffic Lukas Sichert
2026-06-25 9:53 ` Stefan Hanreich
2026-06-19 15:40 ` [PATCH perl-rs v3 4/5] fabrics: bgp: " Lukas Sichert
2026-06-19 15:40 ` [PATCH docs v3 5/5] sdn: drop global ipv6 forwarding workaround from OpenFabric docs Lukas Sichert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f7dbcb5b-0965-4198-9547-a86d662a4f14@proxmox.com \
--to=s.hanreich@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox