What is a Linux bridge, and how do you build one?
Show the answer
Say this first
A Linux bridge is a layer 2 switch inside the kernel. It learns source MACs per port, forwards known
destinations, and floods broadcasts and unknown unicast. Its ports can be physical NICs, VLAN interfaces,
veth ends or VM tap devices. The bridge device itself (br0) is also the host's own port on that switch,
so the host's IP address goes on br0, never on the enslaved NIC. STP is off by default. KVM, Docker and
LXC all build on bridges.
Go deeper
Build one
ip link add br0 type bridge
ip link set ens224 master br0
ip link set ens224 up
ip addr add 10.30.0.5/24 dev br0
ip link set br0 upLook at it
$ ip -br link show master br0
ens224 UP 00:50:56:a1:6c:10 <BROADCAST,MULTICAST,UP,LOWER_UP>
vnet0 UNKNOWN fe:54:00:6b:1e:01 <BROADCAST,MULTICAST,UP,LOWER_UP>
$ bridge fdb show br br0 | grep -v permanent
52:54:00:6b:1e:01 dev vnet0 master br0
00:1c:7f:3a:11:02 dev ens224 master br0The fdb is the MAC address table: the VM's MAC learned on its tap port, the upstream router learned on the NIC.
Defaults worth knowing
- MAC ageing 300 seconds.
- STP disabled (
stp_state 0), so ports forward immediately and a loop is a storm. bridge-utilsandbrctlare the old tools;ip linkandbridgereplace them.
They will ask next
You enslaved the NIC that held the host's IP and the host went offline. Why?
Once a NIC is a bridge port, the bridge takes every frame it receives and delivers it up through
br0. The address left on the NIC no longer receives anything. Move the address (and default route) tobr0, ideally in the same netplan or nmcli change so you do not cut your own session.Can a Linux bridge run spanning tree?
The kernel bridge implements classic 802.1D STP:
ip link set br0 type bridge stp_state 1. For RSTP or MSTP you run the userspacemstpddaemon. Most hypervisor bridges leave STP off and avoid loops by design.Do bridged packets pass through iptables?
Only when the
br_netfiltermodule is loaded andnet.bridge.bridge-nf-call-iptables=1. Kubernetes requires it, and it is a common surprise when a FORWARD policy of DROP starts blocking bridged traffic.
Traps
- Leaving the IP on the physical NIC after enslaving it.
- Bridging two uplinks to the same switch with STP off and creating a loop.