5

I have a small server with a single NIC that I am trying to get a bridge functioning on so that I can run KVM. On this NIC I have a couple IPs statically assigned to it:

eth0 = 192.168.1.1
eth0:1 = 192.168.1.2
eth0:2 = 192.168.1.3
eth0:3 -> Assign the bridge to this

I am attempting to set up a bridge using the following instructions:

sudo brctl addbr br0
sudo brctl addif br0 eth0:3
sudo ifconfig br0 192.168.1.120 netmask 255.255.255.0 up
sudo route add -net 192.168.1.0 netmask 255.255.255.0 br0
sudo route add default gw 192.168.1.1 br0
sudo tunctl -b -u root -t tap0 > /dev/null
sudo ifconfig tap0 up
sudo brctl addif br0 tap0

However, when I do the second command:

sudo brctl addif br0 eth0:3

It puts the ENTIRE eth0 device into promiscuous mode. This knocks the server offline and inaccessible by anything other than locally.

Is there a way to bridge JUST eth0:3 to br0 and not put the entire device into promiscuous mode?

1
  • 1
    The answers to this question are now very obsolete. Since at least 2018, the Linux kernel and iproute offer an impressive array (36, as of 2021, see man ip link add help) of virtual interfaces for use in virtualization. A good reference is here, developers.redhat.com/blog/2018/10/22/…. And, by the way, creating the bridge, and then assigning IPs to both the bridge and one of the bridged interfaces now just works. Oct 10, 2021 at 9:40

2 Answers 2

8

The short answer is, as far as I know, NO.

The long answer: A bridge is a layer 2 device. Think of it as a virtual Switch. To bridge between a network card and an internal device you need to take all data that comes in on the network card and put it on the bridge (minus layer 2 filtering, such as .1q vlans). Let me draw a picture to explain:

This is how you want it to work (a routing scenario):

<vif> ---- <br0> --- <eth0:3> ---- <peth0> --- <internet>

But in reality the virtual bridge always bridges on layer 2:

<br0> --- <peth0>-------<internet>
  |          |
<vif0>    <eth0>
          <eth0:2>

Here peth0 is your physical device, while eth0 is the logical device (with address and such).

To get the scenario you want you will have to use routing instead of bridges. The reason that peth0 is put in promiscious mode is because it could otherwise filter out data headed to devices on the bridge. It doesn't know what the devices on the bridge might listen to.

2
  • 1
    +1 for awesome text-based picture!
    – violet
    Apr 7, 2010 at 12:32
  • What is vif0 short for? Jun 7, 2018 at 14:36
1

Nope, I'm pretty sure it won't work that way. You'll need to put the entire eth0 device into the bridge and add subinterfaces to the bridge interface instead, such as br0:1 etc.

Is there any reason that you're trying to avoid having the additional IPs bound on the br0 interface?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .