Bridge vs routing — when to bridge, when to route

Bridges and routers operate at different layers of the OSI model. The decision between them shapes the network’s behaviour: broadcast domain size, addressing, performance, security boundaries. This lesson is the decision framework every routing engineer needs.

The fundamental difference

flowchart TB
  subgraph Bridge[Bridge - Layer 2]
    B1[Frame]
    B2[Look up MAC in FDB]
    B3[Forward out member port]
  end
  subgraph Route[Router - Layer 3]
    R1[Packet]
    R2[Look up destination IP]
    R3[Look up next-hop]
    R4[Forward out next-hop interface]
  end

A bridge forwards frames based on MAC address. A router forwards packets based on IP address. The two operate on different headers and use different forwarding databases.

The decision framework

Anti-patterns: bridges where routing should be used

• Bridging two different IP subnets. A bridge does not segment broadcast domains; it does not filter broadcasts; it does not apply policies. Two subnets bridged together are effectively one subnet.
• Using a bridge to “connect” two networks. A bridge is transparent at Layer 2. Two networks bridged together share ARP, broadcast, and any Layer 2 anomaly.
• Bridging across a router for “convenience”. Adding a bridge to a router to forward traffic between two interfaces without routing means the operator has not configured any routing. The traffic does not flow through the routing engine; it is not filtered, not policy-routed, and not monitored.

Use cases where bridges are the right choice

• Hypervisor host bridge. A bridge connecting the VMs on a hypervisor to the physical network.
• Transparent firewall in front of a router. A bridge with firewall rules that filters traffic transparently at Layer 2.
• Link aggregation (bonding). A bond is conceptually a bridge; the kernel uses the bonding driver for LACP.
• VLAN-aware bridge for VMs. A bridge that handles multiple VLANs as separate broadcast domains, with VMs on different VLANs.

How the result is validated

The bridge vs routing decision is validated by:

• show bridge — what is bridged.
• show ip route — what is routed.
• tcpdump -i br0 — broadcast traffic on the bridge.
• show interface ethernet — addressing on bridge vs members.

How it fails

The decision failures:

• Bridging two different subnets. A packet from 192.0.2.0/24 to 10.0.0.0/24 stays on the same broadcast domain. ARP broadcasts go everywhere.
• Bridging across a router. The router does not see the traffic at Layer 3. Firewall rules are not applied.
• Bridging instead of routing on a complex network. The operator chose a simpler-looking configuration that does not scale.

Rollback

The recovery from a bridge vs routing mistake:

• Convert bridge to routing. Remove the bridge, configure routing, verify with ping.
• Move IP to bridge. delete interfaces ethernet eth0 address '...'; set interfaces bridge br0 address '...'; commit; save.

Production discipline

Cross-course references

The OPNsense course’s XIV-OPNsense-VLAN covers the equivalent L2/L3 concepts. The Linux course’s XIX-Linux-NetFoundations covers the kernel’s bridge and routing model. The Observability course’s LX-Observability-NetworkObs covers how to alert on routing changes.

Quiz