Hi, can someone explain to me how Flannel with IPv6 is supposed to work when not using

--flannel-ipv6-masq

? I have created my k3s node with the following params:

curl -sfL <https://get.k3s.io> | INSTALL_K3S_EXEC='--disable=servicelb --disable traefik --cluster-cidr=10.42.0.0/16,dead:beef:2:21:1::/104 --kube-controller-manager-arg=node-cidr-mask-size-ipv6=112 --service-cidr=10.43.0.0/16,dead:beef:2:21:1::100:0/112' sh -

dead:beef:2/56

is a Public Routable Network which I own. A pod gets a v6 address and can reach v4 on the internet without issue. Reaching a v6 network does not work tho! I checked the traffic with tcpdump, and I can see the request goes

pod -> router -> target -> router -> XXX

and stops there. At the same time, the router continuously tries to figure out who has the pod ipv6 via Neighbour Discovery. The ND Message reaches the VM hosting the Pod, but is never answered. OS is Rocky 10.1 - and I just realized, apparently only running

nftables

, without iptables. Atleast only

nft

is available as command I saw an old bug https://github.com/k3s-io/k3s/discussions/9807 - but the PR should already be merged. Using

--flannel-ipv6-masq

fixes the issue immediately. Using Cilium instead of Flannel results in the same behaviour, SRC_IP is the hosts v6 IP. I'm half inclined trying Calico and just BGP Peering with the Router (as I'm using metallb-frr with BGP Peering for LB anyway), but I like the simplicity of flannel. Setting a Route to the Pod IP using the VM as next-hop/Gateway also fixes this behaviour, to me it feels like it really is based on the not-answered ND Message.