It is currently impossible to enable ipv6 forwarding on a per-interface
basis like in ipv4. To enable forwarding on an ipv6 interface we need to
enable it on all interfaces and disable it on the other interfaces using
a netfilter rule. This is especially cumbersome if you have lots of
interface and only want to enable forwarding on a few. According to the
sysctl docs [0] the `net.ipv6.conf.all.forwarding` enables forwarding
for all interfaces, while the interface-specific
`net.ipv6.conf.<interface>.forwarding` configures the interface
Host/Router configuration.

This patch modifies the forwarding logic to check both the global
forwarding flag AND the per-interface forwarding flag. Packets are
forwarded if either the global setting (conf.all.forwarding) OR the
interface-specific setting (conf.<interface>.forwarding) is enabled.
This allows enabling forwarding on individual interfaces without
setting the global option.

This change won't allow a `Router`-state interface without forwarding
capabilities anymore, but (with my limited knowledge) I don't think that
should be a problem?

This is quite an impacting change, so I don't really expect this to get
merged. I'm more interested in hearing your feedback and if something
like this would even be considered?

[0]: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
---
 net/ipv6/ip6_output.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7bd29a9ff0db..a7e33ab0946c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -509,7 +509,8 @@ int ip6_forward(struct sk_buff *skb)
 	u32 mtu;
 
 	idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif));
-	if (READ_ONCE(net->ipv6.devconf_all->forwarding) == 0)
+	if ((idev && READ_ONCE(idev->cnf.forwarding) == 0) &&
+	    READ_ONCE(net->ipv6.devconf_all->forwarding) == 0)
 		goto error;
 
 	if (skb->pkt_type != PACKET_HOST)
-- 
2.39.5

Le 20/06/2025 à 17:28, Gabriel Goller a écrit :
> It is currently impossible to enable ipv6 forwarding on a per-interface
> basis like in ipv4. To enable forwarding on an ipv6 interface we need to
> enable it on all interfaces and disable it on the other interfaces using
> a netfilter rule. This is especially cumbersome if you have lots of
> interface and only want to enable forwarding on a few. According to the
> sysctl docs [0] the `net.ipv6.conf.all.forwarding` enables forwarding
> for all interfaces, while the interface-specific
> `net.ipv6.conf.<interface>.forwarding` configures the interface
> Host/Router configuration.
> 
> This patch modifies the forwarding logic to check both the global
> forwarding flag AND the per-interface forwarding flag. Packets are
You cannot change this, it will break existing setups.

> forwarded if either the global setting (conf.all.forwarding) OR the
> interface-specific setting (conf.<interface>.forwarding) is enabled.
> This allows enabling forwarding on individual interfaces without
> setting the global option.
> 
> This change won't allow a `Router`-state interface without forwarding
> capabilities anymore, but (with my limited knowledge) I don't think that
> should be a problem?
> 
> This is quite an impacting change, so I don't really expect this to get
> merged. I'm more interested in hearing your feedback and if something
> like this would even be considered?
The only way I see for this is probably to introduce a new sysctl, say
net.ipv6.conf.<iface>.fwd_per_iface (there is probably a better name).
When the user set net.ipv6.conf.all.forwarding to 0, the kernel should reset all
existing net.ipv6.conf.<iface>.fwd_per_iface entries to keep the backward compat.


Regards,
Nicolas

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date: Fri, 20 Jun 2025 18:09:52 +0200

> Le 20/06/2025 à 17:28, Gabriel Goller a écrit :
>> It is currently impossible to enable ipv6 forwarding on a per-interface
>> basis like in ipv4. To enable forwarding on an ipv6 interface we need to
>> enable it on all interfaces and disable it on the other interfaces using
>> a netfilter rule. This is especially cumbersome if you have lots of
>> interface and only want to enable forwarding on a few. According to the
>> sysctl docs [0] the `net.ipv6.conf.all.forwarding` enables forwarding
>> for all interfaces, while the interface-specific
>> `net.ipv6.conf.<interface>.forwarding` configures the interface
>> Host/Router configuration.
>> 
>> This patch modifies the forwarding logic to check both the global
>> forwarding flag AND the per-interface forwarding flag. Packets are
> You cannot change this, it will break existing setups.

Therefore.
> The only way I see for this is probably to introduce a new sysctl, say
> net.ipv6.conf.<iface>.fwd_per_iface (there is probably a better name).
> When the user set net.ipv6.conf.all.forwarding to 0, the kernel should reset all
> existing net.ipv6.conf.<iface>.fwd_per_iface entries to keep the backward compat.
I agree.

Thanks.