Commands 'set system ipv6 disable-forwarding' and 'set system option performance throughput' are mutually exclusive
At first
set system ipv6 disable-forwarding
Result from sysctl
net.ipv6.conf.all.forwarding = 0
Next
set system option performance throughput
Result from sysctl
net.ipv6.conf.all.forwarding = 1
From my investigation command 'set system option performance throughput' runs 'tuned-adm profile network-throughput'. It enables ipv6 forwarding.
I think that would be a bad idea comparing to other vendors where you can select if you want to do IPv4 routing and/or IPv6 routing. If both are disabled the device will only do switching/bridging.
For example in a IPv4 only environment you want to disable IPv6 forwarding (aka routing) to block any devices who by default (today) have both IPv4 and IPv6 enabled.
A workaround is of course to add firewall rules to block one or the other but the kernel setting net.ipv4.conf.all.forwarding and net.ipv6.conf.all.forwarding enable/disable this at the kernel level.
Question is rather why tuned-adm profile network-throughput is enabling IPv6 routing?
That is what should be dropped instead.
I agree with @Apachez: people should be able to disable IPv4 or IPv6 forwarding if they feel like it. For example, a router used exclusively as a looking glass or a load balancer arguably shouldn't forward any packets on L3.
Can we fix tuned-adm profile without forking tuned?