Baike.dev
Log in
Back to tool/Back to issues
#2388·flannel

VXLAN overlay broken on VMware/NSX: hypervisor silently drops valid VXLAN packets on UDP 8472

Author: UMMAN2005Created Mar 19, 2026Updated Sep 16, 2026
Labelswontfix
Environment:
  • RKE2 with Canal CNI (Flannel VXLAN + Calico)
  • VMware vCloud Director with NSX-backed networking
  • Nodes across multiple AZs on different L3 subnets (10.6.10.0/24 and 10.10.175.0/24)
  • Flannel VXLAN: VNI 1, UDP 8472, MTU 1450
Problem:Pod-to-pod communication fails between nodes on different subnets. The Flannel VXLAN data plane appears fully configured (FDB entries, ARP, routes all correct), but encapsulated packets never reach the destination node.Diagnosis:All standard checks passed:
  • FDB, ARP/neighbor tables, routes: correct on all nodes
  • rp_filter: loose mode (2)
  • UDP 8472 listening on all nodes
  • ICMP at MTU 1450 between nodes: 0% loss
  • Generic UDP (socat) between nodes: works bidirectionally
Simultaneous tcpdump on sender and receiver showed VXLAN replies leave the sender's NIC but never arrive at the receiver's NIC. To isolate, we sent crafted packets from the same source to the same destination on UDP 8472:
Payload | Arrived? -- | -- Random bytes (not valid VXLAN) | Yes Valid VXLAN header, VNI=1 | No Valid VXLAN header, VNI=999 | No Valid VXLAN header, VNI=4096 | No
Root Cause:

Source: flannel-io/flannel

View original on GitHubView discussion on GitHub