Page MenuHomeVyOS Platform
Create Task
Maniphest T8856

wan: WAN load-balancing does not install IPv6 dataplane rules/routes
Needs testing, NormalPublic
Actions

Description

This bug documents and fixes ipv6 for wan load balancing, and works correctly in my live cluster and in a test harness that I built with containerlab.

I authored part of the fix and a test harness. I instructed a coding assistant (in this case OpenAI Codex gpt-5.5 xhigh) to write a testing scenario and to complete the fix. Then I verified the fix.

Below is the LLM-authored summary of the issue and the testing URLs:

WAN load-balancing currently programs the IPv4 dataplane but does not program an equivalent IPv6 dataplane. In a dual-stack deployment, the same configured WAN load-balancing policy installs IPv4 nftables marks, IPv4 policy rules, and IPv4 per-interface default routes, but IPv6 traffic is not handled equivalently.

This should be treated as a bug in existing WAN load-balancing behavior, not as a new feature request. A dual-stack WAN setup should not silently have WLB/failover coverage for IPv4 only.

Version / Base

The proposed fix was rebased and tested against VyOS current:

This base includes the merged T8481 fix:

Local tracking branch for the IPv6 fix:

Observed Behavior

With WAN load-balancing configured on a dual-stack router:

  • IPv4 gets table ip vyos_wanloadbalance.
  • IPv4 gets fwmark policy routing rules.
  • IPv4 gets per-interface WLB routing table default routes.
  • IPv6 does not get an equivalent table ip6 vyos_wanloadbalance.
  • IPv6 does not get equivalent ip -6 rule fwmark policy routing.
  • IPv6 per-interface WLB routing tables are not populated/refreshed with IPv6 default routes.
  • IPv6 failover/load-balancing behavior therefore diverges from IPv4 on the same WLB configuration.

In a dual-stack deployment, this means IPv4 can fail over through WLB while IPv6 does not have equivalent WLB dataplane state.

Expected Behavior

WAN load-balancing should program IPv6 dataplane state equivalent to the IPv4 dataplane when IPv6 routes and IPv6 traffic are present:

  • Render an ip6 vyos_wanloadbalance nftables table.
  • Render IPv6 WLB rules using ip6 saddr / ip6 daddr.
  • Support IPv6 address groups and IPv6 network groups when rendering WLB rules.
  • Install ip -6 rule fwmark lookups for each WLB routing table.
  • Install/refresh IPv6 default routes in the per-interface WLB routing tables.
  • Preserve existing IPv4 behavior.

If set load-balancing wan only-default-route from T8480 / PR #5119 is enabled, IPv6 should also install the equivalent suppress rule:

text
ip -6 rule add fwmark <mark> table main suppress_prefixlength 0 priority <prio>
ip -6 rule add fwmark <mark> table <wlb-table> priority <prio>

suppress_prefixlength 0 is correct for IPv6 as well as IPv4 because the IPv6 default route is ::/0. The rule checks the main table for specific routes and suppresses only the default route, so internal/connected/static/BGP routes are preferred before traffic falls through to WLB per-interface default tables.

Relationship To Existing Tasks

The fix

This fix keeps IPv4 behavior intact and adds IPv6 parity:

  • Add ip6 vyos_wanloadbalance rendering to data/templates/load-balancing/nftables-wlb.j2.
  • Extend the WLB nft rule renderer to render either IPv4 or IPv6 address expressions and skip rules from the wrong address family.
  • Render IPv6 firewall groups as @A6_... and @N6_....
  • Add IPv6 default route discovery for each WLB interface.
  • Install IPv6 default routes into the per-interface WLB routing tables.
  • Restore missing IPv6 table defaults during WLB health polling, matching the existing IPv4 behavior.
  • Install/delete ip -6 rule fwmark policy rules in the same lifecycle as IPv4.
  • Mark IPv6 packets with ct state { new, untracked }, since forwarded IPv6 traffic can arrive as untracked in the relevant nft hook path and otherwise misses WLB marking.

Test Coverage

Smoketest coverage added/extended:

  • Creates veth-backed WAN peers with IPv4 and IPv6 addresses.
  • Adds IPv6 default routes for the simulated WAN interfaces.
  • Verifies IPv4 WLB tables still contain expected default routes.
  • Verifies IPv6 WLB tables contain expected default routes:
text
ip -6 route show table 201
ip -6 route show table 202
  • Verifies existing IPv4 policy rules.
  • Verifies IPv6 policy rules:
text
ip -6 rule show
  • Verifies only-default-route installs IPv4 and IPv6 lookup main suppress_prefixlength 0 rules when enabled.
  • Verifies those suppress rules are absent when only-default-route is not set.

VM-backed Containerlab test coverage, captured in AppMana/network-tests-vyos:

  • Uses Containerlab with a VM-backed VyOS node and Linux LAN/WAN peer nodes.
  • Builds a dual-stack topology:
    • LAN: IPv4 198.51.100.0/24, IPv6 2001:db8:100::/64
    • WAN1: IPv4 203.0.113.0/24, IPv6 2001:db8:201::/64
    • WAN2: IPv4 192.0.2.0/24, IPv6 2001:db8:202::/64
  • Configures WLB failover with WAN1 preferred and WAN2 backup.
  • Verifies IPv4 and IPv6 active path through WAN1.
  • Takes WAN1 down.
  • Verifies WLB health state marks WAN1 down and WAN2 up.
  • Verifies IPv4 and IPv6 fail over through WAN2.
  • Verifies table ip vyos_wanloadbalance and table ip6 vyos_wanloadbalance both contain the expected active WAN jump.
  • Verifies host default routes are unchanged before/after the lab so the test does not disturb workstation WAN networking.

Minimal Reproducer Shape

text
set load-balancing wan hook /bin/true
set load-balancing wan only-default-route
set load-balancing wan interface-health <wan1> failure-count 2
set load-balancing wan interface-health <wan1> nexthop <wan1-ipv4-gw>
set load-balancing wan interface-health <wan1> success-count 1
set load-balancing wan interface-health <wan2> failure-count 2
set load-balancing wan interface-health <wan2> nexthop <wan2-ipv4-gw>
set load-balancing wan interface-health <wan2> success-count 1
set load-balancing wan rule 10 failover
set load-balancing wan rule 10 inbound-interface <lan>
set load-balancing wan rule 10 interface <wan1> weight 100
set load-balancing wan rule 10 interface <wan2> weight 1

The router also has IPv6 defaults learned or installed on both WAN interfaces. After commit, IPv4 WLB state exists, but without the fix the equivalent IPv6 WLB state is missing or incomplete.

Why This Is A Bug

The WLB configuration is interface/rule based and is not explicitly an IPv4-only mode in the user workflow. On dual-stack WANs, only programming IPv4 causes IPv6 traffic to behave differently from IPv4 under the same WLB policy. That breaks dual-stack failover expectations and makes IPv6 behavior incorrect for deployments that rely on WLB for WAN outage handling.

Containerlab Test Artifact URLs

The VM-backed Containerlab test report and evidence bundle were pushed to GitHub:

Details

Version
2026.05.09-0042-rolling
Is it a breaking change?
Behavior change
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

doctorpangloss created this task.May 12 2026, 6:31 PM
doctorpangloss changed the task status from Open to Needs testing.
doctorpangloss triaged this task as Normal priority.
doctorpangloss created this object in space S1 VyOS Public.
doctorpangloss created this object with edit policy "All Users".
doctorpangloss updated the task description. (Show Details)
pasik subscribed.May 12 2026, 7:07 PM