On 2026-06-11 10:11, Lukas Sichert <[email protected]> wrote: > Thanks for looking into it. I will send a v3. Some Comments are inline. > > On 2026-06-08 11:46, Gabriel Goller <[email protected]> wrote: > >> On 03.06.2026 16:29, Lukas Sichert wrote: >>> EVPN zones can route IPv6 subnet traffic through a VNet and an outgoing >>> interface. Until now, this depended on global IPv6 forwarding state, >>> which also changes Router Advertisement handling for the whole host. >>> >>> Use the per-interface 'force_forwarding' setting instead. For IPv6 >>> subnets that need forwarding, generate post-up/post-down commands for >>> both the VNet interface and the outgoing interface. Track interfaces >>> that already received 'force_forwarding' commands to avoid duplicates >>> when multiple subnets share the same outgoing path. Update the expected >>> SDN interface output in the zone tests accordingly. >>> >>> Signed-off-by: Lukas Sichert <[email protected]> >>> --- >>> src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 20 +++++++++++++++---- >>> .../expected_sdn_interfaces | 4 ++++ >>> .../exitnode_snat/expected_sdn_interfaces | 4 ++++ >>> .../exitnodenullroute/expected_sdn_interfaces | 4 ++++ >>> .../evpn/ipv4ipv6/expected_sdn_interfaces | 4 ++++ >>> .../zones/evpn/ipv6/expected_sdn_interfaces | 4 ++++ >>> .../evpn/ipv6underlay/expected_sdn_interfaces | 4 ++++ >>> 7 files changed, 40 insertions(+), 4 deletions(-) >>> >>> diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm >>> b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm >>> index dfbd7e9..7622457 100644 >>> --- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm >>> +++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm >>> @@ -238,11 +238,13 @@ sub generate_sdn_config { >>> my $ipv6 = undef; >>> my $enable_forward_v4 = undef; >>> my $enable_forward_v6 = undef; >>> + my $force_forward_enabled = {}; >>> my $subnets = PVE::Network::SDN::Vnets::get_subnets($vnetid, 1); >>> foreach my $subnetid (sort keys %{$subnets}) { >>> my $subnet = $subnets->{$subnetid}; >>> my $cidr = $subnet->{cidr}; >>> my $mask = $subnet->{mask}; >>> + my $vnet = $subnet->{vnet}; >>> >>> my $gateway = $subnet->{gateway}; >>> if ($gateway) { >>> @@ -266,11 +268,21 @@ sub generate_sdn_config { >>> $enable_forward_v4 = 1 if $gateway; >>> } >>> >>> - if ($subnet->{snat}) { >>> + #find outgoing interface >>> + my ($outip, $outiface) = >>> + >>> PVE::Network::SDN::Zones::Plugin::get_local_route_ip($checkrouteip); >> >> Hmm this is now outside the snat branch, so we will run `ip route get >> 8.8.8.8` >> for subnets without a gateway and with snat enabled, which will always fail. >> >> Could it be that without gateway or snat there isn't an outgoing interface >> and >> thus no need to set force_forwarding? > > The 'get_local_route_ip' does not depend on the zone. '$checkrouteip' is > only the IPv4/IPv6 address of google to resolve the outgoing interface. > So as long as there is an interface, that has an ip address of the same > version as the google address and that has internet access, it won't > fail. If it fails, then the if clause below would prevent any > 'force_forwarding' from being set, but actually it throws an error and > aborts the loop. There is a patch already to make it fail gracefully and > not abort the loop iterating through the subnets.[1] > >> >>> + >>> + if ($outiface && $enable_forward_v6 && >>> !($force_forward_enabled->{$outiface})) { >> >> Will this enable force_forwarding on a ipv4 subnet if there is a ipv6 subnet >> that sets $enable_forward_v6 followed by a ipv4 subnet? I think we need to >> reset >> the $enable_forward_v6 variable before the loop? > > Yes, also, if the '$enable_forward_v6' is set once, then for all > subsequent nets, it remains set. Thanks for pointing it out.
Actually, it is not even necessary to handle this inside the subnet loop. This is because 'force_forwarding' only has to be set for the VNet and the outgoing ipv6 interface. These do not change while iterating through the subnets, so it can be set at the same place where 'ip6-forward' is currently set. The current implementation would emit multiple 'post-up/post-down', if multiple subnets are configured for one VNet. This still means the setting is duplicated for multiple VNets, but since 'sdn apply' regenerates everything, removing one VNet cannot turn off 'force_forwarding' on an interface that is still used by another VNet. >> >>> + push @iface_config, >>> + "post-up echo 1 > >>> /proc/sys/net/ipv6/conf/$outiface/force_forwarding"; >>> + push @iface_config, >>> + "post-down echo 0 > >>> /proc/sys/net/ipv6/conf/$outiface/force_forwarding"; >>> + push @iface_config, "post-up echo 1 > >>> /proc/sys/net/ipv6/conf/$vnet/force_forwarding"; >>> + push @iface_config, "post-down echo 0 > >>> /proc/sys/net/ipv6/conf/$vnet/force_forwarding"; >> >> Could it happen here that with the post-down we can bring down a shared >> interface? e.g. if a zone/vnet use the same vmbr0 bridge and then deleting >> one >> removes the force_forwarding on the other one? >> >> Not sure if this can happen. If yes, we could either just remove the >> post-down >> or add some complicated ref-couting (not a fan of that). > > But wouldn't this require manually executing 'ifdown <vnet>'? Because > for a normal SDN-Apply the whole configuration would be regenerated and > the 'post-down' commands removed. > > [1] https://lore.proxmox.com/all/[email protected]/
