# How am I able to assign an IP to a bridge interface

From what I read, bridging happens below IP layer, yet how am I able to assign an IP to a bridge interface ?

brctl addbr br0
ifconfig br0 IP promisc up


What does the OS do ? it sounds like it provides me a ip network stack on top of br0.

Can iptable rules work on top of this interface then ?

THx. PS : not interested in ebtables. Iam more interested in the concept of what happens under the hood when i assign IP to a bridge interface.

• In some ways you can think of the 'br0' as a virtual interface that is a member of the bridge in addition to the physical interfaces configured for that bridge. For anything layer 3 and above, just treat it like another interface that just happens to have some magic going on at the lower layers that you don't care about. – Zoredache Jun 20 '14 at 22:47
• Or you can think of a bridge like a switch, and the machine with the bridge has an interface connected to that switch too. – David Schwartz Jun 21 '14 at 6:43

Bridging essentially shows up on the computer as another interface that you would normally configure like any other networking interface.

In general, the process is as follows:

Now, you use the other commands as usual to add interfaces. Each distro's autoconfig works a little differently, for example, in RHEL6.x

cat /etc/sysconfig/network-scripts/ifcfg-eth0
...
BRIDGE="br0"
...

cat /etc/sysconfig/network-scripts/ifcfg-br0
...
DEVICE="br0"
TYPE="Bridge"


Here's a good article with more details, for CentOS

Here's the official kernel documentation for brctl.

iptables
Now, with the basics out of the way -- bridging is really heavy-duty in linux. Bridging occurs at a lower level in the network stack and thus things are already being done to these frames before they even transverse iptables. This is a wiiiiide topic, so here's a good page with lots of diagrams.

http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html

• +1 for the last link – resultsway Jun 20 '14 at 22:52

Yes you can use iptables atop a bridge, however ebtables is the more correct way of doing it.

• I disagree with your statement that ebtables is more correct without any qualifications. For layer 3 filtering and above you really should be using iptables, just because what your filtering happens to enter/exit via a bridged interface shouldn't matter. – Zoredache Jun 20 '14 at 22:45