On 03.06.2026 16:29, Lukas Sichert wrote:
> EVPN zones can route IPv6 subnet traffic through a VNet and an outgoing
> interface. Until now, this depended on global IPv6 forwarding state,
> which also changes Router Advertisement handling for the whole host.
>
> Use the per-interface 'force_forwarding' setting instead. For IPv6
> subnets that need forwarding, generate post-up/post-down commands for
> both the VNet interface and the outgoing interface. Track interfaces
> that already received 'force_forwarding' commands to avoid duplicates
> when multiple subnets share the same outgoing path. Update the expected
> SDN interface output in the zone tests accordingly.
>
> Signed-off-by: Lukas Sichert <[email protected]>
> ---
> src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 20 +++++++++++++++----
> .../expected_sdn_interfaces | 4 ++++
> .../exitnode_snat/expected_sdn_interfaces | 4 ++++
> .../exitnodenullroute/expected_sdn_interfaces | 4 ++++
> .../evpn/ipv4ipv6/expected_sdn_interfaces | 4 ++++
> .../zones/evpn/ipv6/expected_sdn_interfaces | 4 ++++
> .../evpn/ipv6underlay/expected_sdn_interfaces | 4 ++++
> 7 files changed, 40 insertions(+), 4 deletions(-)
>
> diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> index dfbd7e9..7622457 100644
> --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
> @@ -238,11 +238,13 @@ sub generate_sdn_config {
> my $ipv6 = undef;
> my $enable_forward_v4 = undef;
> my $enable_forward_v6 = undef;
> + my $force_forward_enabled = {};
> my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1);
> foreach my $subnetid (sort keys %{$subnets}) {
> my $subnet = $subnets->{$subnetid};
> my $cidr = $subnet->{cidr};
> my $mask = $subnet->{mask};
> + my $vnet = $subnet->{vnet};
>
> my $gateway = $subnet->{gateway};
> if ($gateway) {
> @@ -266,11 +268,21 @@ sub generate_sdn_config {
> $enable_forward_v4 = 1 if $gateway;
> }
>
> - if ($subnet->{snat}) {
> + #find outgoing interface
> + my ($outip, $outiface) =
> +
> PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
Hmm this is now outside the snat branch, so we will run `ip route get 8.8.8.8`
for subnets without a gateway and with snat enabled, which will always fail.
Could it be that without gateway or snat there isn't an outgoing interface and
thus no need to set force_forwarding?
> +
> + if ($outiface && $enable_forward_v6 &&
> !($force_forward_enabled->{$outiface})) {
Will this enable force_forwarding on a ipv4 subnet if there is a ipv6 subnet
that sets $enable_forward_v6 followed by a ipv4 subnet? I think we need to reset
the $enable_forward_v6 variable before the loop?
> + push @iface_config,
> + "post-up echo 1 >
> /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> + push @iface_config,
> + "post-down echo 0 >
> /proc/sys/net/ipv6/conf/$outiface/force_forwarding";
> + push @iface_config, "post-up echo 1 >
> /proc/sys/net/ipv6/conf/$vnet/force_forwarding";
> + push @iface_config, "post-down echo 0 >
> /proc/sys/net/ipv6/conf/$vnet/force_forwarding";
Could it happen here that with the post-down we can bring down a shared
interface? e.g. if a zone/vnet use the same vmbr0 bridge and then deleting one
removes the force_forwarding on the other one?
Not sure if this can happen. If yes, we could either just remove the post-down
or add some complicated ref-couting (not a fan of that).
> + $force_forward_enabled->{$outiface} = 1;
> + }
>
> - #find outgoing interface
> - my ($outip, $outiface) =
> -
> PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip);
> + if ($subnet->{snat}) {
> if ($outip && $outiface && $is_evpn_gateway) {
> #use snat, faster than masquerade
> push @iface_config,
> [snip]
Everything also applies to the simplezone afaics.
Thanks for the patch!
