From what I read, bridging happens below IP layer, yet how am I able to assign an IP to a bridge interface ?

brctl addbr br0
ifconfig br0 IP promisc up

What does the OS do ? it sounds like it provides me a ip network stack on top of br0.

Can iptable rules work on top of this interface then ?

THx. PS : not interested in ebtables. Iam more interested in the concept of what happens under the hood when i assign IP to a bridge interface.

  • 2
    In some ways you can think of the 'br0' as a virtual interface that is a member of the bridge in addition to the physical interfaces configured for that bridge. For anything layer 3 and above, just treat it like another interface that just happens to have some magic going on at the lower layers that you don't care about.
    – Zoredache
    Jun 20 '14 at 22:47
  • Or you can think of a bridge like a switch, and the machine with the bridge has an interface connected to that switch too. Jun 21 '14 at 6:43

Bridging essentially shows up on the computer as another interface that you would normally configure like any other networking interface.

In general, the process is as follows:

  1. brctl addbr br0
  2. brctl addif br0 eth0
  3. brctl addif br0 eth1

Now, you use the other commands as usual to add interfaces. Each distro's autoconfig works a little differently, for example, in RHEL6.x

cat /etc/sysconfig/network-scripts/ifcfg-eth0

cat /etc/sysconfig/network-scripts/ifcfg-br0

Here's a good article with more details, for CentOS

Here's the official kernel documentation for brctl.

Now, with the basics out of the way -- bridging is really heavy-duty in linux. Bridging occurs at a lower level in the network stack and thus things are already being done to these frames before they even transverse iptables. This is a wiiiiide topic, so here's a good page with lots of diagrams.


  • +1 for the last link
    – resultsway
    Jun 20 '14 at 22:52

Yes you can use iptables atop a bridge, however ebtables is the more correct way of doing it.

  • 1
    I disagree with your statement that ebtables is more correct without any qualifications. For layer 3 filtering and above you really should be using iptables, just because what your filtering happens to enter/exit via a bridged interface shouldn't matter.
    – Zoredache
    Jun 20 '14 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.