I have a Ubuntu machine with ip_forwarding enabled. iptables forwards too. I have 3 network cards.

eth0 - internet

eth1 - client1

eth2 - client2

I want eth1 and eth2 to be on the same subnet, communicate with each other and access the internet.

I only was able to get it working when I use different subnets for them.

What is the standard way to accomplish this?

  • 4
    Why do you want to have separate network cards for client1 and client2, if they're going to be on the same network?
    – Jenny D
    Apr 10, 2015 at 10:15

4 Answers 4


You want eth1 and eth2 on the same subnet so they should be on the same ethernet link: you should configure your linux box as a bridge between eth1 and eth2.

This will create a new network interface (named br0 below): the kernel will work as a switch bridging your eth1 and eth2 (at layer 2). The IP configuration will be done on br0 instead of eth1 and eth2 (based on the MAC addresses). It will not route between client1 eth1 and client2 eth2.

        eth1    eth2
[ IP  ]<---------->[IP  ]
[ Eth ]<->[Eth ]<->[Eth ]
 Client1  bridge   Client2

Routing is involved between the clients (br0) and Internet eth0 based on the IP addresses:

        br0   eth0
[ IP  ]<->[IP ]<->[IP  ]
[ Eth ]<->[Eth]<->[Eth ]
Client1   router  to internet

From the commandline:

brctl addbr br0
brctl addif br0 eth1 eth2
ip link up br0
ip addr add br0 $ip/$netmask

Or in /etc/network/interfaces:

iface br0 inet static
    bridge_ports eth1 eth2
    address ...
    netmaks ...
    broadcast ...
  • Aliases or bonding would be better. Bridging blurs the line between a server and a network device, and can therefore get you into trouble with your networking team in a lot of places. Apr 11, 2015 at 8:11
  • 2
    @Cameron Kerr: I fail to see how aliases or bonding are relevant here (maybe I misunderstood the question). If you could add details, it might help.
    – ysdx
    Apr 11, 2015 at 8:35
  • Sorry, I was getting slightly confused with another question and missed the bit where his server is also doing routing. I would still use aliases for what are eth1 and eth2 (making say eth1 and eth1:1) and just have one piece of copper (because they are in the same subnet). The bonding is optional, and probably undesirable complexity int this particular instance. Actually, your solution with bridging, while likely undesirable in an enterprise environment ('servers shouldn't provide network functions'), would work nicely to provide redundancy without requiring a bonding-capable switch. Apr 11, 2015 at 8:52
  • Yes, if you can you probably want to use a real switch between the server, client 1 and client 2.
    – ysdx
    Apr 11, 2015 at 8:55

Just to explain why you need a bridge...

A Bridge creates a link between two Layer 2 networks (eth1 and eth2 in your case) to act as a single Layer 2 network. This is Switching.

A Router creates a link between two Layer 3 networks (eth0 and br0 in your case once you create the bridge). This is routing.

With both clients in the same subnet, there is no need for routing. Since you want the same subnet, they are the same Layer 3, so you need a common Layer 2 network underneath.


Bond them for reliability and speed and use aliases to the bonded interface.


You would normally do this using aliases (at least for IPv4)

You would have three interfaces presented, each with a different IP address.

eth0 eth0:1 eth0:2

Doing it with seperate devices is .... painful in the extreme, particularly when you end up with asymmetric routing/firewalling issues (throw in some external NAT device -- eg. some load balancers) and you'll have great fun (if you're a masochist). I tried (quite hard, although policy-based routing was new to me) to get a similar thing working whereby packets would go back out the same interface they came in on.

Hopefully its possible, but its not worth the headache. Love to be proved wrong though.

Not the answer you're looking for? Browse other questions tagged or ask your own question.