OpenPERouter automatically configures several kernel sysctl settings inside the router’s network namespace. These settings are applied every time the controller reconciles the network configuration and are required for correct traffic forwarding and fast failover.

No manual intervention is needed — the controller sets them for you. This page documents what each setting does, why it is required, and which kernel versions are needed.

Common Sysctls #

The following sysctls are always configured regardless of the overlay technology in use.

IP Forwarding #

IP forwarding must be enabled for the router namespace to forward traffic between interfaces. Without these settings, packets received on one interface cannot be routed to another and the router cannot function.

ARP Accept (IPv4) #

Enabling arp_accept allows the kernel to create neighbor table entries from received Gratuitous ARP packets. This is critical for fast EVPN MAC/IP (Type-2) route advertisement, especially during virtual machine live migrations. Without it, the new host may not learn the migrated VM’s MAC address promptly, causing traffic black-holing until the next regular ARP exchange.

The all variant applies to every existing interface; the default variant ensures that any interface created after the sysctl is set inherits the same behavior.

Accept Untracked NA (IPv6) #

accept_untracked_na is the IPv6 counterpart of arp_accept. It lets the kernel create neighbor entries from unsolicited Neighbor Advertisement (NA) packets. This is required for fast EVPN MAC/IP route advertisement with IPv6 addresses, following the same rationale as arp_accept for IPv4.

Kernel Requirement #

The accept_untracked_na sysctl was introduced in Linux kernel 5.18. On older kernels the corresponding /proc/sys/ file does not exist.

Behavior on Older Kernels #

When the controller detects that the proc file for accept_untracked_na is missing, it skips the setting with a warning instead of failing. The controller and the rest of the sysctl configuration continue to work normally.

However, running on a kernel older than 5.18 has the following consequence:

• IPv6 layer 2 traffic might be impacted / mac learning might be slower. Because the kernel cannot learn the migrated VM’s IPv6 address from unsolicited NA packets, the EVPN Type-2 route for the new location is not advertised promptly. Traffic directed at the VM’s IPv6 address may be black-holed until regular Neighbor Discovery catches up.

IPv4 traffic is not affected by this limitation since the arp_accept sysctl is available on all supported kernel versions.

If you run EVPN workloads that rely on IPv6 and require fast failover during live migrations, ensure your nodes run kernel 5.18 or later.

SRv6 Sysctls #

The following sysctls are only configured when SRv6 is enabled on the Underlay.

SRv6 Segment Routing (seg6) #

seg6_enabled enables Segment Routing over IPv6 (SRv6) on all network interfaces, allowing them to process and forward packets with SRv6 segment routing headers. This is required for the kernel to accept and process SRv6 encapsulated traffic.

seg6_flowlabel set to 1 instructs the kernel to compute the IPv6 flow label using seg6_make_flowlabel(). This improves ECMP load balancing for SRv6 traffic by generating flow labels that reflect the inner packet headers.

VRF Strict Mode #

VRF strict mode ensures that each VRF is associated with a unique routing table. Without this setting, multiple VRFs could inadvertently share a routing table, causing BGP routes to be rejected (visible as B>r in FRR output). This sysctl is set each time a new VRF is created for an L3VPN.

Disable Reverse Path Filter #

Reverse path filtering (rp_filter) is disabled on each VRF interface created for SRv6 L3VPNs. This is necessary because SRv6 decapsulated traffic may have source addresses that do not match the local routing table in the VRF, causing the kernel to silently drop legitimate packets.

Summary Table #