# Bridge with Firewall (L2 Filtering)

> Layer 2 transparent bridge firewall on VyOS - inline L2 filtering without IP changes, bridge groups, and traffic inspection

Source: https://opennix.org/en/docs/vyos/examples/firewall-bridge/


Bridge interface with firewall for transparent (Layer 2) firewall deployments.

## Scenario

- Transparent Firewall: VyOS operates as a Layer 2 bridge with filtering
- Minimal Configuration: No changes to IP addressing required
- Inline Deployment: Between switch and router

## Configuration

```bash
# Bridge Interface
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 address '10.10.1.254/24'

# Bridge Firewall
set firewall bridge forward filter default-action 'drop'

set firewall bridge forward filter rule 10 action 'accept'
set firewall bridge forward filter rule 10 state established 'enable'
set firewall bridge forward filter rule 10 state related 'enable'

set firewall bridge forward filter rule 20 action 'accept'
set firewall bridge forward filter rule 20 protocol 'tcp'
set firewall bridge forward filter rule 20 destination port '80,443'

set firewall bridge forward filter rule 100 action 'drop'
set firewall bridge forward filter rule 100 log 'enable'

commit
```

## References

- [VyOS Bridge](https://docs.vyos.io/en/latest/configuration/interfaces/bridge.html)
- [VyOS Bridge Firewall Example](https://docs.vyos.io/en/latest/configexamples/firewall-bridge.html)