# Bridge Interfaces (L2) in VyOS

> VyOS bridge interfaces - join ports at L2, configure STP, VLAN-aware bridge, MAC learning, and traffic filtering for switching scenarios

Source: https://opennix.org/en/docs/vyos/interfaces/vyos-bridge/



A bridge connects multiple Ethernet segments at Layer 2 (the data link layer), forwarding packets based on MAC addresses.

## Overview

A bridge in VyOS:
- Operates at Layer 2 (the OSI data link layer)
- Forwards frames based on MAC addresses
- Supports the Spanning Tree Protocol (STP)
- Can have an IP address for management
- Supports VLAN-aware mode
- Implements the IEEE 802.1d standard

**Use cases**:
- Joining several physical interfaces into a single L2 domain
- VLAN switching
- Virtualization (connecting VMs to a physical network)
- Building a virtual switch

## Basic Configuration

### Creating a bridge

```
set interfaces bridge br0
commit
```

### Adding member interfaces

```
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 member interface eth3
commit
```

Now eth1, eth2, and eth3 belong to the same L2 broadcast domain.

### IP address on the bridge

```
set interfaces bridge br0 address 192.168.1.1/24
commit
```

The IP address is assigned to the bridge interface itself for management or routing.

### Description

```
set interfaces bridge br0 description 'LAN Bridge'
commit
```

## Member Interface Parameters

### Priority

Port priority for STP:

```
set interfaces bridge br0 member interface eth1 priority 32
commit
```

Value: 0-63 (default 32). Lower = higher priority.

### Cost

Path cost for STP:

```
set interfaces bridge br0 member interface eth1 cost 10
commit
```

Affects root port selection in STP. Lower = more preferred.

### Isolated

An isolated port (cannot communicate with other isolated ports):

```
set interfaces bridge br0 member interface eth2 isolated
commit
```

Useful for guest networks (private VLAN).

## Spanning Tree Protocol (STP)

STP prevents loops in L2 networks.

### Enabling STP

```
set interfaces bridge br0 stp
commit
```

By default, STP is **disabled**.

### Bridge Priority

The bridge priority used to elect the root bridge:

```
set interfaces bridge br0 priority 4096
commit
```

Values: multiples of 4096 (0, 4096, 8192, ..., 61440).
A lower value = a higher chance of becoming the root bridge.

### Hello Time

The interval for sending BPDUs:

```
set interfaces bridge br0 hello-time 2
commit
```

Value in seconds (default 2).

### Forward Delay

The delay before a port transitions to the forwarding state:

```
set interfaces bridge br0 forward-delay 15
commit
```

Value in seconds (default 15).

### Max Age

The maximum age of a BPDU:

```
set interfaces bridge br0 max-age 20
commit
```

Value in seconds (default 20).

## Aging

MAC address aging - the retention time for entries in the FDB (Forwarding Database).

```
set interfaces bridge br0 aging 300
commit
```

Value in seconds (default 300).

## IGMP/MLD

### IGMP Snooping

Optimizing multicast traffic:

```
set interfaces bridge br0 igmp snooping
commit
```

Allows the bridge to "listen" to IGMP queries and forward multicast only to the ports that need it.

### IGMP Querier

```
set interfaces bridge br0 igmp querier
commit
```

The bridge becomes an IGMP querier and generates membership queries.

## VLAN Filtering

A bridge can operate as a VLAN-aware switch.

### Enabling VLAN mode

```
set interfaces bridge br0 enable-vlan
commit
```

### Native VLAN

The untagged VLAN for a member interface:

```
set interfaces bridge br0 member interface eth1 native-vlan 1
commit
```

Traffic without a VLAN tag will be tagged with the specified VLAN.

### Allowed VLANs

The VLANs allowed on a member interface:

```
set interfaces bridge br0 member interface eth1 allowed-vlan 10
set interfaces bridge br0 member interface eth1 allowed-vlan 20
set interfaces bridge br0 member interface eth1 allowed-vlan 30
commit
```

A range of VLANs:

```
set interfaces bridge br0 member interface eth2 allowed-vlan 10-50
commit
```

### VLAN sub-interfaces (VIF)

Creating L3 interfaces for VLANs:

```
set interfaces bridge br0 vif 10 address 192.168.10.1/24
set interfaces bridge br0 vif 10 description 'VLAN 10 - Management'

set interfaces bridge br0 vif 20 address 192.168.20.1/24
set interfaces bridge br0 vif 20 description 'VLAN 20 - Users'

commit
```

## Configuration Examples

### Simple bridge (L2 switch)

Joining three ports into a single L2 domain:

```
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 member interface eth3
set interfaces bridge br0 stp
commit
```

### Bridge with a management IP

```
set interfaces bridge br0 address 192.168.1.1/24
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 description 'LAN Bridge'
set interfaces bridge br0 stp
commit
```

Now you can manage VyOS through 192.168.1.1 from any port (eth1, eth2).

### VLAN-aware bridge (trunk switch)

Creating trunk ports with multiple VLANs:

```
# Enable VLAN
set interfaces bridge br0 enable-vlan

# Trunk port to another switch (all VLANs)
set interfaces bridge br0 member interface eth1 allowed-vlan 10-50

# Access port for VLAN 10
set interfaces bridge br0 member interface eth2 allowed-vlan 10
set interfaces bridge br0 member interface eth2 native-vlan 10

# Access port for VLAN 20
set interfaces bridge br0 member interface eth3 allowed-vlan 20
set interfaces bridge br0 member interface eth3 native-vlan 20

# L3 interfaces for VLANs
set interfaces bridge br0 vif 10 address 192.168.10.1/24
set interfaces bridge br0 vif 20 address 192.168.20.1/24

# STP
set interfaces bridge br0 stp

commit
```

### Bridge for VMs (virtualization)

Connecting a physical interface to virtual machines:

```
set interfaces bridge br0 member interface eth0
set interfaces bridge br0 member interface tap0
set interfaces bridge br0 member interface tap1
set interfaces bridge br0 stp
commit
```

tap0 and tap1 are virtual machine interfaces.

### Bridge with isolated ports (Private VLAN)

Ports cannot communicate with each other (guest isolation):

```
set interfaces bridge br0 member interface eth0
set interfaces bridge br0 member interface eth1 isolated
set interfaces bridge br0 member interface eth2 isolated
set interfaces bridge br0 member interface eth3 isolated
commit
```

eth0 - uplink (can communicate with everyone).
eth1, eth2, eth3 - isolated from each other.

### Multi-VLAN bridge with inter-VLAN routing

```
# VLAN-aware bridge
set interfaces bridge br0 enable-vlan

# Trunk ports
set interfaces bridge br0 member interface eth1 allowed-vlan 10
set interfaces bridge br0 member interface eth1 allowed-vlan 20
set interfaces bridge br0 member interface eth1 allowed-vlan 30

set interfaces bridge br0 member interface eth2 allowed-vlan 10-30

# L3 interfaces (VLAN gateways)
set interfaces bridge br0 vif 10 address 192.168.10.1/24
set interfaces bridge br0 vif 10 description 'VLAN 10 - Management'

set interfaces bridge br0 vif 20 address 192.168.20.1/24
set interfaces bridge br0 vif 20 description 'VLAN 20 - Users'

set interfaces bridge br0 vif 30 address 192.168.30.1/24
set interfaces bridge br0 vif 30 description 'VLAN 30 - Servers'

# Enable IP forwarding (enabled by default in VyOS)
set interfaces bridge br0 stp

commit
```

Now VLANs 10, 20, and 30 can communicate through VyOS (inter-VLAN routing).

### Bridge with a Bond interface

Aggregation for redundancy:

```
# Bond interface
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 member interface eth2
set interfaces bonding bond0 mode '802.3ad'

# Bridge with bond
set interfaces bridge br0 member interface bond0
set interfaces bridge br0 member interface eth3
set interfaces bridge br0 stp

commit
```

### Secure bridge with a firewall

```
# Bridge
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 address 192.168.1.1/24

# Firewall for bridge traffic
set firewall bridge forward filter rule 10 action accept
set firewall bridge forward filter rule 10 state established
set firewall bridge forward filter rule 10 state related

set firewall bridge forward filter rule 20 action drop
set firewall bridge forward filter rule 20 state invalid

set firewall bridge forward filter default-action accept

commit
```

## Operational Commands

### Viewing bridge interfaces

```
show bridge
```

Example output:
```
bridge name     bridge id               STP enabled     interfaces
br0             8000.000c29abcdef       yes             eth1
                                                        eth2
                                                        eth3
```

### Forwarding Database (FDB)

MAC address table:

```
show bridge br0 fdb
```

Example output:
```
port    mac addr                flags
eth1    00:0c:29:12:34:56
eth2    00:0c:29:ab:cd:ef
eth3    00:0c:29:98:76:54       permanent
```

### Multicast Database (MDB)

Multicast groups:

```
show bridge br0 mdb
```

### VLAN information

```
show bridge br0 vlan
```

### STP information

```
show bridge br0 spanning-tree
```

## Troubleshooting

### Bridge does not forward traffic

Check the member interfaces:
```
show interfaces
```

Make sure all member interfaces are in the UP state.

Check the firewall:
```
show firewall bridge forward filter
```

### STP blocks ports

Check the STP state:
```
show bridge br0 spanning-tree
```

Ports may be in the blocking or listening state.

Lower the bridge priority to make it the root:
```
set interfaces bridge br0 priority 0
commit
```

### Broadcast storm

There may be a loop in the L2 network.

Enable STP:
```
set interfaces bridge br0 stp
commit
```

Check the cables for loops.

### VLAN traffic does not pass

Check allowed-vlan:
```
show configuration interfaces bridge br0
```

Make sure the required VLANs are allowed on the member interfaces.

Check native-vlan for untagged traffic.

### MAC table is full

Increase the aging time:
```
set interfaces bridge br0 aging 600
commit
```

Or decrease it for faster refresh:
```
set interfaces bridge br0 aging 120
commit
```

## Performance

### MTU

Set the same MTU on all member interfaces:

```
set interfaces bridge br0 mtu 1500
commit
```

Member interfaces automatically inherit the MTU from the bridge.

### Offloading

The bridge can use hardware offloading if supported:

```
show interfaces bridge br0 offload
```

### Jumbo Frames

For high-performance networks:

```
set interfaces bridge br0 mtu 9000
commit
```

All member interfaces must support jumbo frames.

## Security

### MAC-based ACL

Filtering by MAC address through the firewall:

```
set firewall bridge forward filter rule 100 action drop
set firewall bridge forward filter rule 100 source mac-address aa:bb:cc:dd:ee:ff
commit
```

### Storm Control

Limiting broadcast/multicast:

Use firewall rate limiting:

```
set firewall bridge forward filter rule 200 action accept
set firewall bridge forward filter rule 200 limit rate 1000/second
commit
```

### Port Security

Isolated ports for guest networks:

```
set interfaces bridge br0 member interface eth5 isolated
commit
```

## Comparison with Other Technologies

### Bridge vs Bond

| Characteristic | Bridge | Bond |
|---------------|--------|------|
| OSI layer | L2 | L2 |
| Purpose | Connecting segments | Link aggregation |
| Redundancy | Through STP | Through LACP/active backup |
| Used for | Switching, VLAN | Increasing throughput |

### Bridge vs VLAN

A bridge can contain VLANs (VLAN-aware bridge). A VLAN is a method of segmenting an L2 domain.

## Integration

### With a DHCP server

```
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1
set interfaces bridge br0 address 192.168.1.1/24
commit
```

### With a firewall

```
set firewall bridge forward filter rule 10 action accept
set firewall bridge forward filter rule 10 source address 192.168.1.0/24
commit
```

### With a VPN

A bridge can contain VPN interfaces (tap):

```
set interfaces bridge br0 member interface tap0
commit
```

## Best Practices

1. **Enable STP** - to prevent loops
2. **Use VLANs** - for network segmentation
3. **Document** - which ports belong to which VLANs
4. **MTU** - keep it identical on all member interfaces
5. **Isolated ports** - for guest/IoT devices
6. **Monitor the FDB** - keep track of the MAC table
7. **Firewall** - protect bridge traffic
8. **Aging** - tune it to the load
9. **Priority** - plan the STP topology
10. **Redundancy** - use Bond for the uplink

## Limitations

- A bridge forwards broadcasts - this can be a problem in large networks
- STP convergence takes time (30-50 seconds)
- A large number of VLANs requires more resources
- Hardware offload depends on the NIC

## Next Steps

- [Bond](/docs/vyos/interfaces/vyos-bond/) - link aggregation
- [VLAN](/docs/vyos/interfaces/vyos-vlan/) - detailed VLAN configuration
- [Firewall](/docs/vyos/firewall/) - protecting L2 traffic
- [DHCP Server](/docs/vyos/services/vyos-dhcp/) - integration with DHCP