Repository navigation
Count IPv6 traffic in virtual router network usage #14591
Description
On isolated and VPC networks, the virtual router's usage scripts only read its iptables counters, so only IPv4 traffic is counted for network usage. IPv6 traffic goes through nftables, and those counters aren't read.
If a network has IPv6 enabled, VMs can send as much IPv6 traffic as they like and none of it shows up in usage.
Shared networks already count IPv6. They take usage from the libvirt stats on each VM's NIC. Those stats also pick up traffic between VMs on the same network, plus DHCP, ARP and ND.
It would be good to have routers count IPv6 too. That way, usage on a dual-stack network covers all of a VM's traffic.
This came up while working on #14578.
#14583 accepts IPv6 entries in network.usage.exempt.cidrs, but routers can't use them until they count IPv6.
A follow-up PR will apply them to shared networks. I'm working on it now and will link it here once it's raised.
Activity
github-actions commentedon Nov 6, 2026
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
🎯 Triage report
On isolated and VPC networks, the virtual router counts only IPv4 traffic for network usage, because its counters use iptables while IPv6 goes through nftables. A dual-stack network therefore under-reports usage. Shared networks already count IPv6 via libvirt NIC stats. The reporter proposes that routers count IPv6 too, so usage is consistent. This is linked to #14578 and to the IPv6 exemption config added in #14583.
📊 Assessment
🔗 Similar issues
💡 Notes and suggestions
network.usage.exempt.cidrsIPv6 entries. Maintainers may want to confirm whether routers should count IPv6 before the exemption list is used for VR networks.Add this agentic workflow to your repo
To install this agentic workflow, run
weizhouapache commentedon Nov 6, 2026
as I remember, the nftables rules also have some counters
MitchDrage commentedon Nov 7, 2026
Ok yes you are correct - the IPv6 firewall rules do have counters, but only on the default rule at the end of each chain and they reset when the rules are reapplied.
I'm looking at adding dedicated IPv6 usage counters in nftables, the same way IPv4 uses its own NETWORK_STATS chains in iptables.
I've corrected the issue description.