Re: [PATCH network v2 1/5] sdn: evpn: enable force_forwarding for ipv6 forwarding to subnets

[Gabriel Goller <g.goller@proxmox.com>]

On 03.06.2026 16:29, Lukas Sichert wrote:
> EVPN zones can route IPv6 subnet traffic through a VNet and an outgoing
> interface. Until now, this depended on global IPv6 forwarding state,
> which also changes Router Advertisement handling for the whole host.
> 
> Use the per-interface 'force_forwarding' setting instead. For IPv6
> subnets that need forwarding, generate post-up/post-down commands for
> both the VNet interface and the outgoing interface. Track interfaces
> that already received 'force_forwarding' commands to avoid duplicates
> when multiple subnets share the same outgoing path. Update the expected
> SDN interface output in the zone tests accordingly.
> 
> Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
> ---
>  src/PVE/Network/SDN/Zones/EvpnPlugin.pm       | 20 +++++++++++++++----
>  .../expected_sdn_interfaces                   |  4 ++++
>  .../exitnode_snat/expected_sdn_interfaces     |  4 ++++
>  .../exitnodenullroute/expected_sdn_interfaces |  4 ++++
>  .../evpn/ipv4ipv6/expected_sdn_interfaces     |  4 ++++
>  .../zones/evpn/ipv6/expected_sdn_interfaces   |  4 ++++
>  .../evpn/ipv6underlay/expected_sdn_interfaces |  4 ++++
>  7 files changed, 40 insertions(+), 4 deletions(-)
> 
> diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> index dfbd7e9..7622457 100644
> --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> @@ -238,11 +238,13 @@ sub generate_sdn_config {
>      my $ipv6 = undef;
>      my $enable_forward_v4 = undef;
>      my $enable_forward_v6 = undef;
> +    my $force_forward_enabled = {};
>      my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
>      foreach my $subnetid (sort keys %{$subnets}) {
>          my $subnet = $subnets->{$subnetid};
>          my $cidr = $subnet->{cidr};
>          my $mask = $subnet->{mask};
> +        my $vnet = $subnet->{vnet};
>  
>          my $gateway = $subnet->{gateway};
>          if ($gateway) {
> @@ -266,11 +268,21 @@ sub generate_sdn_config {
>              $enable_forward_v4 = 1 if $gateway;
>          }
>  
> -        if ($subnet->{snat}) {
> +        #find outgoing interface
> +        my ($outip, $outiface) =
> +            PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);

Hmm this is now outside the snat branch, so we will run `ip route get 8.8.8.8`
for subnets without a gateway and with snat enabled, which will always fail.

Could it be that without gateway or snat there isn't an outgoing interface and
thus no need to set force_forwarding?

> +
> +        if ($outiface && $enable_forward_v6 && !($force_forward_enabled->{$outiface})) {

Will this enable force_forwarding on a ipv4 subnet if there is a ipv6 subnet
that sets $enable_forward_v6 followed by a ipv4 subnet? I think we need to reset
the $enable_forward_v6 variable before the loop?

> +            push @iface_config,
> +                "post-up echo 1 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> +            push @iface_config,
> +                "post-down echo 0 > /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> +            push @iface_config, "post-up echo 1 > /proc/sys/net/ipv6/conf/$vnet/force_forwarding";
> +            push @iface_config, "post-down echo 0 > /proc/sys/net/ipv6/conf/$vnet/force_forwarding";

Could it happen here that with the post-down we can bring down a shared
interface? e.g. if a zone/vnet use the same vmbr0 bridge and then deleting one
removes the force_forwarding on the other one?

Not sure if this can happen. If yes, we could either just remove the post-down
or add some complicated ref-couting (not a fan of that).

> +            $force_forward_enabled->{$outiface} = 1;
> +        }
>  
> -            #find outgoing interface
> -            my ($outip, $outiface) =
> -                PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
> +        if ($subnet->{snat}) {
>              if ($outip && $outiface && $is_evpn_gateway) {
>                  #use snat, faster than masquerade
>                  push @iface_config,
> [snip]

Everything also applies to the simplezone afaics.

Thanks for the patch!