Left a comment on another closed ticket: https://vyos.dev/T3655#178710 which seemed entirely relevant but @Viacheslav left feedback indicating that it is an unspecified problem that is unrelated, feel free to change the title of this bug report to better address the problem if not accurate. Here is a demonstration of the problem:
table inet vrf_zones { map ct_iface_map { typeof iifname : ct zone elements = { "HE" : 132, "WAN" : 128, "eth0" : 128, "tun0" : 132, "eth1" : 256, "eth2" : 384, "veth0" : 132, "veth1" : 256, "VMNET" : 256, "FASTNETMON" : 384 } } chain vrf_zones_ct_in { type filter hook prerouting priority raw; policy accept; counter packets 37682 bytes 9857007 ct original zone set iifname map @ct_iface_map } chain vrf_zones_ct_out { type filter hook output priority raw; policy accept; counter packets 10822 bytes 1502078 ct original zone set oifname map @ct_iface_map } }
this table doesn't work for IPv6:
vyos@vyos:~$ sudo ip vrf exec VMNET ping 198.18.5.0 PING 198.18.5.0 (198.18.5.0) 56(84) bytes of data. 64 bytes from 198.18.5.0: icmp_seq=1 ttl=64 time=0.070 ms ^C --- 198.18.5.0 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.070/0.070/0.070/0.000 ms vyos@vyos:~$ sudo ip vrf exec VMNET ping6 2001:470:1f15:1ed:1::1 PING 2001:470:1f15:1ed:1::1(2001:470:1f15:1ed:1::1) 56 data bytes ^C --- 2001:470:1f15:1ed:1::1 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1039ms
deleting the table fixes it:
vyos@vyos:~$ sudo nft delete table inet vrf_zones vyos@vyos:~$ sudo ip vrf exec VMNET ping6 2001:470:1f15:1ed:1::1 PING 2001:470:1f15:1ed:1::1(2001:470:1f15:1ed:1::1) 56 data bytes 64 bytes from 2001:470:1f15:1ed:1::1: icmp_seq=1 ttl=64 time=0.063 ms 64 bytes from 2001:470:1f15:1ed:1::1: icmp_seq=2 ttl=64 time=0.051 ms ^C --- 2001:470:1f15:1ed:1::1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1014ms rtt min/avg/max/mdev = 0.051/0.057/0.063/0.006 ms
I'm at a bit of a loss for how to "fix" this without having to delete the table, maybe the point here arises from the fact that I'm simply connecting two vrfs together with a veth pair:
set interfaces virtual-ethernet veth0 peer-name veth1 set interfaces virtual-ethernet veth1 peer-name veth0 set interfaces virtual-ethernet veth0 address 2001:470:1f15:1ed:1::1/80 set interfaces virtual-ethernet veth1 address 2001:470:1f15:1ed:1::2/80 set interfaces virtual-ethernet veth0 address 198.18.5.0/23 set interfaces virtual-ethernet veth1 address 198.18.4.1/23 set interfaces virtual-ethernet veth0 vrf HE set interfaces virtual-ethernet veth1 vrf VMNET
vyos@vyos# sudo ip vrf exec VMNET ping6 2001:470:1f15:1ed:1::1 PING 2001:470:1f15:1ed:1::1(2001:470:1f15:1ed:1::1) 56 data bytes ^C --- 2001:470:1f15:1ed:1::1 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1033ms [edit] vyos@vyos# sudo nft delete table inet vrf_zones [edit] vyos@vyos# sudo ip vrf exec VMNET ping6 2001:470:1f15:1ed:1::1 PING 2001:470:1f15:1ed:1::1(2001:470:1f15:1ed:1::1) 56 data bytes 64 bytes from 2001:470:1f15:1ed:1::1: icmp_seq=1 ttl=64 time=0.063 ms 64 bytes from 2001:470:1f15:1ed:1::1: icmp_seq=2 ttl=64 time=0.040 ms ^C --- 2001:470:1f15:1ed:1::1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1053ms rtt min/avg/max/mdev = 0.040/0.051/0.063/0.011 ms [edit] vyos@vyos#