networkd: since v256 IPv6Forwarding doesn't forward any packets about systemd

[YHNdnzj]

Please use IPv6Forwarding=yes in networkd.conf, rather than .network file, it controls /proc/sys/net/ipv6/conf/all/forwarding. This is not a bug in networkd, but how the kernel designed, or at most, a bug in the kernel.

Yet it would be very confusing to users in this case? I think this at the minimum deserves proper documentation on our side. Also, on top of that we should enable global forwarding in kernel if the global IPv6Forward= is not set, but one interface enables forwarding. Then, disable the per-interface forwarding for all other interfaces.

Currently, the behavior is completely broken. We claim that IPMasquerade=yes would imply IPv4/v6Forward=, yet without enabling it globally that could not work.

[IlyaMZP]

I can confirm this, after update to systemd-256 (and 256.1) ipv6 forwarding stopped working.
Here are the configs for the WAN and LAN interfaces I use. I replaced IPForward=yes to IPv4Forwarding=yes and IPv6Forwarding=yes after updating to 256.

[Match]
Name=end0

[Network]
Description=WAN Interface
LinkLocalAddressing=ipv6
IPv6AcceptRA=yes
DHCP=yes
IPv4Forwarding=yes
IPv6Forwarding=yes

[DHCPv4]
Hostname=router
UseHostname=no
UseDNS=yes
UseNTP=no
UseSIP=no
UseRoutes=no
UseGateway=yes

[IPv6AcceptRA]
UseDNS=no
DHCPv6Client=yes

[Match]
Name=enp1s0

[Link]
RequiredForOnline=no

[Network]
Description=LAN Interface
Address=10.0.0.1/24
DHCPServer=yes
IPv6SendRA=yes
IPv6AcceptRA=no
DHCPv6PrefixDelegation=yes
IPMasquerade=ipv4
LinkLocalAddressing=ipv6
IPv6DuplicateAddressDetection=1

[DHCPServer]
PoolOffset=20
PoolSize=150
EmitDNS=yes
DNS=8.8.8.8

[IPv6SendRA]
EmitDNS=yes
EmitDomains=no

[DHCPPrefixDelegation]
UplinkInterface=end0
SubnetId=0x1
Announce=yes

[freswa]

The implementation for IPv4Forwarding and IPv6Forwarding seems to have similar behavior. It sets /proc/sys/net/ipv<4/6>/conf/<ifname>/forwarding to 1. While this is the correct behavior for IPv4, It's not for IPv6. From the kernel docs:

/proc/sys/net/ipv6/* Variables:

[...]
conf/all/forwarding - BOOLEAN
	Enable global IPv6 forwarding between all interfaces.

	IPv4 and IPv6 work differently here; e.g. netfilter must be used
	to control which interfaces may forward packets and which not.

	This also sets all interfaces' Host/Router setting
	'forwarding' to the specified value.  See below for details.

	This referred to as global forwarding.

[...]
conf/interface/*:
	Change special settings per interface.

	The functional behaviour for certain settings is different
	depending on whether local forwarding is enabled or not.

[...]
forwarding - INTEGER
	Configure interface-specific Host/Router behaviour.

	Note: It is recommended to have the same setting on all
	interfaces; mixed router/host scenarios are rather uncommon.

	Possible values are:
		0 Forwarding disabled
		1 Forwarding enabled

	FALSE (0):

	By default, Host behaviour is assumed.  This means:

	1. IsRouter flag is not set in Neighbour Advertisements.
	2. If accept_ra is TRUE (default), transmit Router
	   Solicitations.
	3. If accept_ra is TRUE (default), accept Router
	   Advertisements (and do autoconfiguration).
	4. If accept_redirects is TRUE (default), accept Redirects.

	TRUE (1):

	If local forwarding is enabled, Router behaviour is assumed.
	This means exactly the reverse from the above:

	1. IsRouter flag is set in Neighbour Advertisements.
	2. Router Solicitations are not sent unless accept_ra is 2.
	3. Router Advertisements are ignored unless accept_ra is 2.
	4. Redirects are ignored.

	Default: 0 (disabled) if global forwarding is disabled (default),
		 otherwise 1 (enabled).

Which means we have to enable global forwarding whenever a single interface has IPv6Forwarding set afaiu.

[yuwata]

Please use IPv6Forwarding=yes in networkd.conf, rather than .network file, it controls /proc/sys/net/ipv6/conf/all/forwarding.
This is not a bug in networkd, but how the kernel designed, or at most, a bug in the kernel.

[yuwata]

First of all, why /proc/sys/net/ipv6/conf/all/forwarding needs to be enabled? I cannot find anything special for the sysctl value. It seems to simply enable IPv6 forwarding for all interfaces.

[yuwata]

Ah, ip6_forward()...

[yuwata]

OK. I will update documentation.