Bridge anti-patterns — what not to do with bridges

A handful of bridge configurations reliably cause trouble in production. This lesson is the catalog of anti-patterns and the correct configuration that replaces each.

Anti-pattern 1 — bridging different subnets

[edit]
vyos@vyos# set interfaces bridge br0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth1
[edit]
vyos@vyos# commit

Two networks bridged together share ARP, broadcast, and any Layer 2 anomaly. The bridge does not segment broadcasts; ARP floods both networks.

Correct configuration: route between the subnets.

Anti-pattern 2 — missing STP

[edit]
vyos@vyos# set interfaces bridge br0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth1
[edit]
vyos@vyos# commit

STP is not enabled. If the bridges form a loop (e.g. two bridges connected with two paths), frames flood infinitely.

Correct configuration: enable STP and let it block the redundant path:

set interfaces bridge br0 stp

Anti-pattern 3 — IP on member

[edit]
vyos@vyos# set interfaces bridge br0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth1
[edit]
vyos@vyos# set interfaces ethernet eth0 address '192.0.2.1/24'
[edit]
vyos@vyos# commit

The bridge has no IP address; the member has the IP. Routing is unpredictable because the kernel is confused about which interface owns the address.

Correct configuration: move the IP to the bridge.

Anti-pattern 4 — complex topology with too many bridges

A network with many bridges, each with a few members, is operationally hard to manage. Each bridge needs STP, member configuration, and IP addressing.

Correct configuration: consolidate to fewer bridges with more members, or use a hardware switch.

Anti-pattern 5 — bridge without members

[edit]
vyos@vyos# set interfaces bridge br0
[edit]
vyos@vyos# set interfaces bridge br0 address '192.0.2.1/24'
[edit]
vyos@vyos# commit

A bridge with no members has no forwarding path. Frames are dropped because there are no members to forward to.

Correct configuration: add members or remove the bridge.

Anti-pattern 6 — bridge with sub-interface member

A bridge member that is a VLAN sub-interface (eth0.10) is unusual. The bridge can have it, but the configuration is confusing because the bridge already handles broadcast domains.

Correct configuration: use the VLAN sub-interface directly, or use a VLAN-aware bridge.

How the result is validated

show bridge
show spanning-tree
show configuration commands | match "interfaces bridge"

The first shows the bridge state; the second shows STP; the third shows the configuration.

How it fails

The meta-anti-pattern is the configuration that is “working” but fragile:

• Two subnets bridged: ARP storms under load.
• Missing STP: one configuration change creates a loop.
• IP on member: routing breaks after a reboot.

Rollback

The recovery from an anti-pattern:

• Bridging different subnets: convert to routing.
• Missing STP: enable STP and identify the loop.
• IP on member: move to bridge.
• Bridge without members: add members or remove.

Production discipline

Cross-course references

The OPNsense course’s XIV-OPNsense-VLAN covers the equivalent L2/L3 concepts. The Linux course’s XXII-Linux-NetTroubleshoot covers the underlying network troubleshooting. The Observability course’s LX-Observability-NetworkObs covers how to alert on bridge anti-patterns.

Quiz