I have read countless articles on how to configure a network bridge and they all seem ambiguous or incomplete or just plain erroneous (configure my WAN port with 192.168.x.x to obtain Internet connectivity?).
My scenario: Ubuntu 16 and KVM with the wrinkle that security is via Sophos UTM running on the virtual machine. Physical machine has two Ethernet ports, only one of which has a cable inserted.
"Authorities" disagree on whether one must have one or two physical Ethernet ports to setup a bridge.
I am particularly confused by the seemingly dominant view that says you need only one port and you configure it so that the physical machine (PM) and the virtual machine (VM) share one IP address.
In that scenario how does the firewall work? Which machine receives whatever is passed by the firewall? And regardless of the answer, does not one machine become unreachable thereby? Or do both machines receive all passed packets?
I avoid the above confusion if I have two Ethernet ports and set up the bridge on the LAN port. Now I have an IP address leading into the VM and another remains pointed at the PM. Firewalling is now uncomplicated since I have different IP addresses for different targets.
But accounts of this second scenario never contain any discussion of firewalls or IP tables. But don't I need to have rules forwarding traffic between the two ports? My PC is not a router (not without configuration that is). Data packets coming in one port don't just magically find their way to the second port just because they share a common chassis do they?
I think the correct answer is the WAN port is assigned a public IP. The LAN port is bridged and given a private IP. Firewall rules then forward all traffic, except SSH (so I have a way to remote into PM still), from the WAN to the LAN port. I then configure Sophos on the VM to do the heavy lifting firewall-wise. The rest of the LAN is connected downstream of the Sophos VM. What do my IPtables config commands look like in and out?
I have spent hundreds of hours trying to figure this out myself. Help!
PS - One last question. Does the bridge get a public or private IP address? I assume it needs to have an address that is on the same network segment as the VM's attached to it have. In my case that means a private IP address.