Greetings, We found that ICMP destination unreachable isn't sent if VRF forwarding isn't configured, i.e. /proc/sys/net/ipv4/conf/<vrf_net_device>/forwarding isn't set. The relevant code is:
static int ip_error(struct sk_buff *skb) { ... // in_dev is the vrf net_device if (!IN_DEV_FORWARD(in_dev)) { switch (rt->dst.error) { case EHOSTUNREACH: __IP_INC_STATS(net, IPSTATS_MIB_INADDRERRORS); break; case ENETUNREACH: __IP_INC_STATS(net, IPSTATS_MIB_INNOROUTES); break; } goto out; } ... out: kfree_skb(skb); return 0; } The question: is it intended to be set? The basic forwarding seems to be working without. We do set it on the slave net devices. Thank you, Stephen.