Documentation
VyOS Documentation
VyOS Configuration Examples
Bridge with Firewall (L2 Filtering)

Bridge with Firewall (L2 Filtering)

Bridge interface with firewall for transparent (Layer 2) firewall deployments.

Scenario

  • Transparent Firewall: VyOS operates as a Layer 2 bridge with filtering
  • Minimal Configuration: No changes to IP addressing required
  • Inline Deployment: Between switch and router

Configuration

# Bridge Interface
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 address '10.10.1.254/24'

# Bridge Firewall
set firewall bridge forward filter default-action 'drop'

set firewall bridge forward filter rule 10 action 'accept'
set firewall bridge forward filter rule 10 state established 'enable'
set firewall bridge forward filter rule 10 state related 'enable'

set firewall bridge forward filter rule 20 action 'accept'
set firewall bridge forward filter rule 20 protocol 'tcp'
set firewall bridge forward filter rule 20 destination port '80,443'

set firewall bridge forward filter rule 100 action 'drop'
set firewall bridge forward filter rule 100 log 'enable'

commit

References

Reviewed by OpenNix LLC · Last updated on
Firewall with VRF IsolationDHCP Relay through GRE-Bridge