Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there really any meaning attached for assigning a IP address to a bridge interface. Note : the bridge is created using brctl and then an IP address is assigned to br0 created.

Is there any advantange/usage by assigning a IP address to the bridge interface

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Attaching an IP address to a bridge device is only necessary if you want to orignate, or receive IP traffic on that interface. If you are merely using your two NICs as a repeater (of sorts) then you shouldn't need an IP address.

share|improve this answer

Well, yes; you can talk to it, using IP. I'm sorry if this sounds a flip answer; it's not intended to be.

Firstly, remember that the individual members of a bridge should not have addresses assigned to them, so you can't talk to the bridge that way.

Then, consider my problem, when I had a three legged firewall. Inside, on a simple interface, was 192.168.0.0/16; this would need to be NATted when traffic went outside. On the other two interfaces, I had 213.219.1.0/25, but I had a need for some machines in that address space to be exposed to the internet, and others to be behind a firewall - but the machines already there were addressed in such a way that I couldn't split it into 213.219.1.0/26 and 213.219.1.64/26. I had members of 213.219.1.0/25, high and low, on both the external and the DMZ interfaces.

My only choice was to make a bridge out of the external and DMZ interfaces, and use --physdev-in and --physdev-out rules to make firewalling decisions about bridging the packets across those interfaces.

But for traffic in and out of the internal interface, this was full layer-3 routing. The "external" interface of the firewall needed to have an address in order to NAT packets from the internal to the external interfaces, and it also needed an address for eg remote administration from the internet, VPN terminations, and so on.

So that was one circumstances where, as far as I could determine, a bridge interface definitely needed an IP address of its own. Does that make sense?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.