Bridges — Layer 2 forwarding in software

A bridge is a Layer 2 forwarding device implemented in software on the Linux kernel. It connects multiple interfaces into a single broadcast domain, learns MAC addresses, and forwards frames between members. This lesson covers the bridge concept, the basic configuration, and when bridges are appropriate in a routing estate.

What a bridge is

flowchart LR
  A[eth0] --> B[br0<br/>bridge]
  C[eth1] --> B
  D[eth2] --> B
  B --> E[Layer 2<br/>broadcast domain]

A bridge is a virtual interface that joins multiple physical interfaces into a single Layer 2 segment. The bridge itself has an IP address (and acts as the gateway for the segment), and each member interface is part of the same broadcast domain.

When bridges make sense

Bridges are appropriate when:

• The operator needs a single broadcast domain across multiple physical interfaces.
• The network has multiple hosts on the same Layer 2 segment that must reach each other without routing.
• The operator is implementing a virtual switch in software (e.g. for VMs on the same hypervisor host).
• The operator is connecting two segments that need to be bridged at Layer 2 (e.g. a transparent firewall in front of a router).

Bridges are NOT appropriate when:

• The operator needs inter-VLAN routing — use VLAN sub-interfaces on a single Ethernet instead.
• The operator is connecting two different IP networks — use routing instead.
• The operator needs the broadcast domain to span only a few ports and a hardware switch is available — use the switch.

Basic bridge configuration

[edit]
vyos@vyos# set interfaces bridge br0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth1
[edit]
vyos@vyos# set interfaces bridge br0 address '192.0.2.1/24'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The bridge br0 has eth0 and eth1 as members. The bridge has its own IP address 192.0.2.1/24. Hosts on eth0 and eth1 can reach each other at Layer 2.

Reading the bridge forwarding database

vyos@vyos:~$ show bridge
Interface      MAC Address        VLAN  State      Age
br0            52:54:00:12:34:56  -     forwarding  0
eth0           aa:bb:cc:dd:ee:ff  -     forwarding  12
eth1           11:22:33:44:55:66  -     forwarding  8

The bridge’s FDB shows the MAC addresses learned on each interface and their state (forwarding, learning, blocking).

Spanning Tree Protocol

vyos@vyos:~$ show spanning-tree
Bridge br0
  Root ID:    8000.525400123456
             Cost: 4
             Port: 1 (eth0)
  Bridge ID:  8000.525400123456
             Cost: 0
             Port: 1 (eth0)
Interface  Role    State    Cost    Priority
eth0       Root    FWD      4       128
eth1       Desg    FWD      4       128

STP prevents loops in the bridge. If the bridge has redundant paths to the same destination, STP blocks one of them.

How the result is validated

show bridge
ip link show br0
ip addr show br0
brctl show br0
brctl showmacs br0

The first shows the VyOS view; the second shows the kernel state; the third shows the addresses; the fourth shows members; the fifth shows the FDB.

How it fails

The production failure modes the engineer must recognise:

• Bridge with no members. A bridge without members has no forwarding path. Frames are dropped.
• Member with its own IP address. Confuses routing; the address belongs on the bridge.
• Bridge loop. Two bridges connected to each other with two paths create a forwarding loop. STP must be enabled to detect and block.
• STP not converging. A bridge with STP disabled in a loop topology floods frames infinitely.
• Broadcast storm. A misconfigured bridge in a loop floods broadcast frames. The network becomes unusable.

Rollback

The recovery from a bad bridge configuration:

• Missing member: set interfaces bridge br0 member interface ethN; commit; save.
• IP on member: delete interfaces ethernet eth0 address '...'; set interfaces bridge br0 address '...'; commit; save.
• Bridge loop: enable STP and identify the redundant path.

Production discipline

Cross-course references

The Proxmox course’s XXIX-Proxmox-Networking covers the host-side bridge configuration. The OPNsense course’s XIV-OPNsense-VLAN covers the equivalent L2 concepts. The Linux course’s XIX-Linux-NetFoundations covers the kernel’s bridge model.

Quiz