The QinQ zone applies its configured MTU to the zone bridge and to the vnet bridge, but not to the ln_<zone>/pr_<zone> veth pair it creates as the uplink for an untagged vnet. Both ends therefore stay at the kernel default of 1500.
For a vnet without a tag, pr_<zone> is a port of the vnet bridge itself, so that veth sits directly in the guest data path and silently caps the whole zone at 1500 while every other interface in the chain reports the configured MTU. Frames above the limit are dropped by the bridge with no error and no counter. Guests hit the ceiling at ping -M do -s 1476, since br_forward() still permits mtu + hard_header_len + VLAN_HLEN bytes of frame. Tagged vnets are unaffected, as they attach through z_<zone>.<ctag> and never traverse the veth. That also makes the bug easy to miss when trying to reproduce it. Set the MTU on both ends of the pair. Guarding on $mtu keeps the generated config byte-identical for zones without an explicit MTU. Signed-off-by: Thomas Glanzmann <[email protected]> --- src/PVE/Network/SDN/Zones/QinQPlugin.pm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/PVE/Network/SDN/Zones/QinQPlugin.pm b/src/PVE/Network/SDN/Zones/QinQPlugin.pm index a75940c..00f8814 100644 --- a/src/PVE/Network/SDN/Zones/QinQPlugin.pm +++ b/src/PVE/Network/SDN/Zones/QinQPlugin.pm @@ -150,11 +150,13 @@ sub generate_sdn_config { @iface_config = (); push @iface_config, "link-type veth"; push @iface_config, "veth-peer-name $zone_notag_uplinkpeer"; + push @iface_config, "mtu $mtu" if $mtu; push(@{ $config->{$zone_notag_uplink} }, @iface_config) if !$config->{$zone_notag_uplink}; @iface_config = (); push @iface_config, "link-type veth"; push @iface_config, "veth-peer-name $zone_notag_uplink"; + push @iface_config, "mtu $mtu" if $mtu; push(@{ $config->{$zone_notag_uplinkpeer} }, @iface_config) if !$config->{$zone_notag_uplinkpeer}; -- 2.53.0
