Bridge Interfaces (L2) in VyOS

A bridge connects multiple Ethernet segments at Layer 2 (the data link layer), forwarding packets based on MAC addresses.

Overview

A bridge in VyOS:

Operates at Layer 2 (the OSI data link layer)
Forwards frames based on MAC addresses
Supports the Spanning Tree Protocol (STP)
Can have an IP address for management
Supports VLAN-aware mode
Implements the IEEE 802.1d standard

Use cases:

Joining several physical interfaces into a single L2 domain
VLAN switching
Virtualization (connecting VMs to a physical network)
Building a virtual switch

Basic Configuration

Creating a bridge

set interfaces bridge br0
commit

Adding member interfaces

set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 member interface eth3
commit

Now eth1, eth2, and eth3 belong to the same L2 broadcast domain.

IP address on the bridge

set interfaces bridge br0 address 192.168.1.1/24
commit

The IP address is assigned to the bridge interface itself for management or routing.

Description

set interfaces bridge br0 description 'LAN Bridge'
commit

Member Interface Parameters

Priority

Port priority for STP:

set interfaces bridge br0 member interface eth1 priority 32
commit

Value: 0-63 (default 32). Lower = higher priority.

Cost

Path cost for STP:

set interfaces bridge br0 member interface eth1 cost 10
commit

Affects root port selection in STP. Lower = more preferred.

Isolated

An isolated port (cannot communicate with other isolated ports):

set interfaces bridge br0 member interface eth2 isolated
commit

Useful for guest networks (private VLAN).

Spanning Tree Protocol (STP)

STP prevents loops in L2 networks.

Enabling STP

set interfaces bridge br0 stp
commit

By default, STP is disabled.

Bridge Priority

The bridge priority used to elect the root bridge:

set interfaces bridge br0 priority 4096
commit

Values: multiples of 4096 (0, 4096, 8192, …, 61440). A lower value = a higher chance of becoming the root bridge.

Hello Time

The interval for sending BPDUs:

set interfaces bridge br0 hello-time 2
commit

Value in seconds (default 2).

Forward Delay

The delay before a port transitions to the forwarding state:

set interfaces bridge br0 forward-delay 15
commit

Value in seconds (default 15).

Max Age

The maximum age of a BPDU:

set interfaces bridge br0 max-age 20
commit

Value in seconds (default 20).

Aging

MAC address aging - the retention time for entries in the FDB (Forwarding Database).

set interfaces bridge br0 aging 300
commit

Value in seconds (default 300).

IGMP/MLD

IGMP Snooping

Optimizing multicast traffic:

set interfaces bridge br0 igmp snooping
commit

Allows the bridge to “listen” to IGMP queries and forward multicast only to the ports that need it.

IGMP Querier

set interfaces bridge br0 igmp querier
commit

The bridge becomes an IGMP querier and generates membership queries.

VLAN Filtering

A bridge can operate as a VLAN-aware switch.

Enabling VLAN mode

set interfaces bridge br0 enable-vlan
commit

Native VLAN

The untagged VLAN for a member interface:

set interfaces bridge br0 member interface eth1 native-vlan 1
commit

Traffic without a VLAN tag will be tagged with the specified VLAN.

Allowed VLANs

The VLANs allowed on a member interface:

set interfaces bridge br0 member interface eth1 allowed-vlan 10
set interfaces bridge br0 member interface eth1 allowed-vlan 20
set interfaces bridge br0 member interface eth1 allowed-vlan 30
commit

A range of VLANs:

set interfaces bridge br0 member interface eth2 allowed-vlan 10-50
commit

VLAN sub-interfaces (VIF)

Creating L3 interfaces for VLANs:

set interfaces bridge br0 vif 10 address 192.168.10.1/24
set interfaces bridge br0 vif 10 description 'VLAN 10 - Management'

set interfaces bridge br0 vif 20 address 192.168.20.1/24
set interfaces bridge br0 vif 20 description 'VLAN 20 - Users'

commit

Configuration Examples

Simple bridge (L2 switch)

Joining three ports into a single L2 domain:

set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 member interface eth3
set interfaces bridge br0 stp
commit

Bridge with a management IP

set interfaces bridge br0 address 192.168.1.1/24
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 description 'LAN Bridge'
set interfaces bridge br0 stp
commit

Now you can manage VyOS through 192.168.1.1 from any port (eth1, eth2).

VLAN-aware bridge (trunk switch)

Creating trunk ports with multiple VLANs:

# Enable VLAN
set interfaces bridge br0 enable-vlan

# Trunk port to another switch (all VLANs)
set interfaces bridge br0 member interface eth1 allowed-vlan 10-50

# Access port for VLAN 10
set interfaces bridge br0 member interface eth2 allowed-vlan 10
set interfaces bridge br0 member interface eth2 native-vlan 10

# Access port for VLAN 20
set interfaces bridge br0 member interface eth3 allowed-vlan 20
set interfaces bridge br0 member interface eth3 native-vlan 20

# L3 interfaces for VLANs
set interfaces bridge br0 vif 10 address 192.168.10.1/24
set interfaces bridge br0 vif 20 address 192.168.20.1/24

# STP
set interfaces bridge br0 stp

commit

Bridge for VMs (virtualization)

Connecting a physical interface to virtual machines:

set interfaces bridge br0 member interface eth0
set interfaces bridge br0 member interface tap0
set interfaces bridge br0 member interface tap1
set interfaces bridge br0 stp
commit

tap0 and tap1 are virtual machine interfaces.

Bridge with isolated ports (Private VLAN)

Ports cannot communicate with each other (guest isolation):

set interfaces bridge br0 member interface eth0
set interfaces bridge br0 member interface eth1 isolated
set interfaces bridge br0 member interface eth2 isolated
set interfaces bridge br0 member interface eth3 isolated
commit

eth0 - uplink (can communicate with everyone). eth1, eth2, eth3 - isolated from each other.

Multi-VLAN bridge with inter-VLAN routing

# VLAN-aware bridge
set interfaces bridge br0 enable-vlan

# Trunk ports
set interfaces bridge br0 member interface eth1 allowed-vlan 10
set interfaces bridge br0 member interface eth1 allowed-vlan 20
set interfaces bridge br0 member interface eth1 allowed-vlan 30

set interfaces bridge br0 member interface eth2 allowed-vlan 10-30

# L3 interfaces (VLAN gateways)
set interfaces bridge br0 vif 10 address 192.168.10.1/24
set interfaces bridge br0 vif 10 description 'VLAN 10 - Management'

set interfaces bridge br0 vif 20 address 192.168.20.1/24
set interfaces bridge br0 vif 20 description 'VLAN 20 - Users'

set interfaces bridge br0 vif 30 address 192.168.30.1/24
set interfaces bridge br0 vif 30 description 'VLAN 30 - Servers'

# Enable IP forwarding (enabled by default in VyOS)
set interfaces bridge br0 stp

commit

Now VLANs 10, 20, and 30 can communicate through VyOS (inter-VLAN routing).

Bridge with a Bond interface

Aggregation for redundancy:

# Bond interface
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 member interface eth2
set interfaces bonding bond0 mode '802.3ad'

# Bridge with bond
set interfaces bridge br0 member interface bond0
set interfaces bridge br0 member interface eth3
set interfaces bridge br0 stp

commit

Secure bridge with a firewall

# Bridge
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 address 192.168.1.1/24

# Firewall for bridge traffic
set firewall bridge forward filter rule 10 action accept
set firewall bridge forward filter rule 10 state established
set firewall bridge forward filter rule 10 state related

set firewall bridge forward filter rule 20 action drop
set firewall bridge forward filter rule 20 state invalid

set firewall bridge forward filter default-action accept

commit

Operational Commands

Viewing bridge interfaces

show bridge

Example output:

bridge name     bridge id               STP enabled     interfaces
br0             8000.000c29abcdef       yes             eth1
                                                        eth2
                                                        eth3

Forwarding Database (FDB)

MAC address table:

show bridge br0 fdb

Example output:

port    mac addr                flags
eth1    00:0c:29:12:34:56
eth2    00:0c:29:ab:cd:ef
eth3    00:0c:29:98:76:54       permanent

Multicast Database (MDB)

Multicast groups:

show bridge br0 mdb

VLAN information

show bridge br0 vlan

STP information

show bridge br0 spanning-tree

Troubleshooting

Bridge does not forward traffic

Check the member interfaces:

show interfaces

Make sure all member interfaces are in the UP state.

Check the firewall:

show firewall bridge forward filter

STP blocks ports

Check the STP state:

show bridge br0 spanning-tree

Ports may be in the blocking or listening state.

Lower the bridge priority to make it the root:

set interfaces bridge br0 priority 0
commit

Broadcast storm

There may be a loop in the L2 network.

Enable STP:

set interfaces bridge br0 stp
commit

Check the cables for loops.

VLAN traffic does not pass

Check allowed-vlan:

show configuration interfaces bridge br0

Make sure the required VLANs are allowed on the member interfaces.

Check native-vlan for untagged traffic.

MAC table is full

Increase the aging time:

set interfaces bridge br0 aging 600
commit

Or decrease it for faster refresh:

set interfaces bridge br0 aging 120
commit

Performance

MTU

Set the same MTU on all member interfaces:

set interfaces bridge br0 mtu 1500
commit

Member interfaces automatically inherit the MTU from the bridge.

Offloading

The bridge can use hardware offloading if supported:

show interfaces bridge br0 offload

Jumbo Frames

For high-performance networks:

set interfaces bridge br0 mtu 9000
commit

All member interfaces must support jumbo frames.

Security

MAC-based ACL

Filtering by MAC address through the firewall:

set firewall bridge forward filter rule 100 action drop
set firewall bridge forward filter rule 100 source mac-address aa:bb:cc:dd:ee:ff
commit

Storm Control

Limiting broadcast/multicast:

Use firewall rate limiting:

set firewall bridge forward filter rule 200 action accept
set firewall bridge forward filter rule 200 limit rate 1000/second
commit

Port Security

Isolated ports for guest networks:

set interfaces bridge br0 member interface eth5 isolated
commit

Comparison with Other Technologies

Bridge vs Bond

Characteristic	Bridge	Bond
OSI layer	L2	L2
Purpose	Connecting segments	Link aggregation
Redundancy	Through STP	Through LACP/active backup
Used for	Switching, VLAN	Increasing throughput

Bridge vs VLAN

A bridge can contain VLANs (VLAN-aware bridge). A VLAN is a method of segmenting an L2 domain.

Integration

With a DHCP server

set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1
set interfaces bridge br0 address 192.168.1.1/24
commit

With a firewall

set firewall bridge forward filter rule 10 action accept
set firewall bridge forward filter rule 10 source address 192.168.1.0/24
commit

With a VPN

A bridge can contain VPN interfaces (tap):

set interfaces bridge br0 member interface tap0
commit

Best Practices

Enable STP - to prevent loops
Use VLANs - for network segmentation
Document - which ports belong to which VLANs
MTU - keep it identical on all member interfaces
Isolated ports - for guest/IoT devices
Monitor the FDB - keep track of the MAC table
Firewall - protect bridge traffic
Aging - tune it to the load
Priority - plan the STP topology
Redundancy - use Bond for the uplink

Limitations

A bridge forwards broadcasts - this can be a problem in large networks
STP convergence takes time (30-50 seconds)
A large number of VLANs requires more resources
Hardware offload depends on the NIC

Next Steps

Bond - link aggregation
VLAN - detailed VLAN configuration
Firewall - protecting L2 traffic
DHCP Server - integration with DHCP

Reviewed by OpenNix LLC · Last updated on 29 July 2026

VLAN Interfaces (802.1Q) in VyOS Bond Interfaces (Link Aggregation) in VyOS