31
votes
Accepted
Docker breaks libvirt bridge network
The problem, actually a feature: br_netfilter
The explanation is that the bridge netfilter code is enabled by Docker for internal container isolation: intended among other usages for stateful bridge ...
- 12.8k
29
votes
Possible to list members of a network bridge?
Alternatively, there's a more recent command provided by iproute2, used together with ip link to manage bridges: the bridge command. It can handle new bridge features not available through brctl (like ...
- 12.8k
19
votes
Accepted
What is the systemd-networkd equivalent of post-up? (dynamic bridge MAC configuration)
It turns out that due to the heavy modular concept of systemd and systemd-networkd the scripting question needs to be tackled from a different angle: instead of looking for scripting with the bridge ....
- 581
17
votes
Bridging wlan0 to eth0
Bridge wlan and 4addr:
Bridging wlan0 is a pain. You normally cannot add it to a bridge interface (brctl returns "Operation not permitted"), and using VirtualBox "bridged" filter ...
- 389
11
votes
Cannot ioctl TUNSETIFF tap0: Device or resource busy (errno=16)
This happens if you did not stop the service openvpn and immediately made changes to the configuration file - as a result, after restarting, you still have a lost process with the old interface. It is ...
- 111
10
votes
Configuring 1:1 Nat using Firewalld for VM's
NAT is done at the firewall/router level.
Depending on your firewall/router you can setup 1:1 NAT's the only thing to keep in mind is you can only setup one port to one IP.
So if you have 2 web ...
- 9,588
10
votes
Accepted
Linux: bridges, VLANs and RSTP
In Linux, VLANs and bridges are completely separate constructs, and Linux bridges are are not "VLAN aware".
When you create a VLAN interface, Linux tags/untags packets on that interface before ...
- 369
7
votes
Iptables - Bridge and Forward chain
If you do not have the need to use iptables with the bridge on your system you can permanently disable it by using either of the following:
Adding an iptables rule:
iptables -I FORWARD -m physdev --...
- 261
7
votes
Linux: bridges, VLANs and RSTP
Since Linux kernel 3.0 or so, it's no longer true that Linux bridges are "not VLAN aware". https://linux-blog.anracom.com/2017/10/30/fun-with-veth-devices-in-unnamed-linux-network-namespaces-i/ and ...
- 681
6
votes
Is there a way to determine which virtual interface belongs to a virtual machine in a kvm host?
Run virsh domiflist myVM. This command will list all the interfaces related to VM myVM.
Interface Type Source Model MAC
---------------------------------------------------------------
...
- 146
6
votes
Accepted
How to match both sides of a virtual ethernet link?
As you suspect, the @if13 does refer to the number in the first column, which is the ifindex number (at least, "ifindex" is the name of the variable exposed by libnl, used to talk netlink to the ...
- 176
6
votes
Why do we need a LAN physical interface bridged with OpenVPN TAP interface to get functional OpenVPN in bridge mode?
OpenVPN tap interface operates at the layer 2 of the ISO/OSI model and so it needs a layer 2 (read: bridge/switch) connection to the main, real interface.
I strongly suggest you to reconfigure your ...
- 50.7k
6
votes
Accepted
Possible to list members of a network bridge?
The command which handles bridging in Linux is brctl.
The command you are most likely looking for is
brctl show
The bridge name is, of-course on the left, and all the interfaces connected to ...
- 6,302
6
votes
Ping does not work on TAP interfaces with bridge
I think you didn't grasp what's the role and usage of tun/tap interfaces, and that's the cause of your problems. Let me explain.
Consider the tap0 interface as the end of a virtual wire with two ...
- 12.8k
6
votes
In virtual networking, how does a Virtual Switch differ from a linux kernel bridge?
First of all, many terms in IT are created by marketing departments, so they mean whatever the manufacturer wants it to mean.
Functionally, bridges and switches are the same thing. They forward ...
- 2,179
5
votes
Bridging wlan0 to eth0
4addr as described in other answers is certainly the best way when supported by the adapter/driver, but not all of them does. NAT might work for some things, but getting proper communication both ways ...
5
votes
Accepted
Why do I need restart a VM after restarted a bridge to get network working?
When you take the bridge down it disconnects all the attached IFs, when you bring it back up, only the IFs defined in ifcfg files (or whatever ubuntu uses instead) are added automatically. KVM guests ...
- 18.9k
5
votes
How to configure firewall on user defined Docker bridge?
Elaborating on Marek's Answer of setting the bridge name at creation time.
docker network create --driver bridge -o \
"com.docker.network.bridge.name"="mynetwork_name" mynetwork
or if using a ...
- 51
5
votes
Docker breaks libvirt bridge network
If the above threats not solving your problem, here's how I resolved the problem on my Debian Stretch.
1st, save your current iptables
iptables-save > your-current-iptables.rules
2nd, delete ALL ...
- 151
5
votes
Docker breaks libvirt bridge network
I fixed this issue by adding the following line to /usr/lib/systemd/system/docker.service:
[Service]
ExecStartPost=iptables -I DOCKER-USER -i br0 -o br0 -j ACCEPT
Note that I don't have to create the ...
5
votes
Bridge + nftables: How to redirect incoming HTTP/HTTPS traffic to local port 8080?
Here is what worked for me:
root@kali:~# nft add table bridge t1
root@kali:~# nft add chain bridge t1 c1 { type filter hook prerouting priority 0\; }
root@kali:~# nft add rule bridge t1 c1 tcp dport ...
- 101
4
votes
Setting up bridged LXC containers with static IPs
The best way I find and the quickest is to use the lxc profiles
lxc profile list - command the list all the profiles you have
Then
lxc profile copy default minecraft(this is the name of your new ...
- 41
4
votes
Connecting two LANs with VPN
You can do this by putting a firewall on each LAN that acts at the default route. Each firewall can then run a VPN solution like OpenVPN or IPSec to make the two networks available to each other. This ...
- 6,330
4
votes
Accepted
Bridge interface for KVM VMs with access to Internet?
When you add your host Ethernet controller to the bridge br0 (connected to a VM) you are effectively creating two new devices on the network (two devices with new MAC-addresses) instead of the old one....
- 3,725
4
votes
Accepted
UDP traffic not forwarded from Docker containers -> Docker host
I figured it out.
We had a Trend Micro (anti-virus) agent running in the SOE which I didn't know about.
Fixing it was as simple as:
# systemctl stop ds_agent.service
# pkill ds_agent
Not exactly ...
- 241
4
votes
Accepted
Why is a physical interface not part of the docker_gwbridge?
The mechanism used by Docker is iptables. Iptables rules are added by Docker so packets from the docker_gwbridge are forwarded and then natted (masquerade) when traffic is sent to the outside world.
...
- 1,436
4
votes
How to create a bridge / tun tap under linux inside /etc/network/interfaces?
I'll try to answer your questions.
A bridge interface doesn't require an ip address to switch frames between ports. Sure, you can configure a bridge interface without an ip address. In this case your ...
- 5,232
4
votes
Accepted
What's a Linux bridge in terms of a physical one?
You have described, and your image depicts, routing between two bridges and a physical interface not part of a bridge. Among the many other things Linux does is Layer 3 routing, and this is what is ...
- 248k
4
votes
Possible to list members of a network bridge?
The best way I feel is to list the contents in this directory :
/sys/class/net/<bridge-name>/brif
This helps you parse the output. brctl show and other commands will be difficult to parse
4
votes
Bridging two (a physical ethernet with a virtual ethernet) different subnets on linux?
You are thinking wrong on several levels.
A bridge is a layer 2 device. If you connect two networks by a bridge, you are creating a single layer 2 network comprising both of the connected networks - ...
- 4,179
Only top scored, non community-wiki answers of a minimum length are eligible