Home / server / Questions / 236618
Accepted
kumar
Asked: 2011-02-17 23:49:51 +0800 CST

Adding ip address to a bridge interface

  • 772

Is there really any meaning attached for assigning a IP address to a bridge interface. Note : the bridge is created using brctl and then an IP address is assigned to br0 created.

Is there any advantange/usage by assigning a IP address to the bridge interface

linux networking bridge linux-networking

3 Answers

  1. Best Answer

    Attaching an IP address to a bridge device is only necessary if you want to orignate, or receive IP traffic on that interface. If you are merely using your two NICs as a repeater (of sorts) then you shouldn't need an IP address.

    • 5

  2. Well, yes; you can talk to it, using IP. I'm sorry if this sounds a flip answer; it's not intended to be.

    Firstly, remember that the individual members of a bridge should not have addresses assigned to them, so you can't talk to the bridge that way.

    Then, consider my problem, when I had a three legged firewall. Inside, on a simple interface, was 192.168.0.0/16; this would need to be NATted when traffic went outside. On the other two interfaces, I had 213.219.1.0/25, but I had a need for some machines in that address space to be exposed to the internet, and others to be behind a firewall - but the machines already there were addressed in such a way that I couldn't split it into 213.219.1.0/26 and 213.219.1.64/26. I had members of 213.219.1.0/25, high and low, on both the external and the DMZ interfaces.

    My only choice was to make a bridge out of the external and DMZ interfaces, and use --physdev-in and --physdev-out rules to make firewalling decisions about bridging the packets across those interfaces.

    But for traffic in and out of the internal interface, this was full layer-3 routing. The "external" interface of the firewall needed to have an address in order to NAT packets from the internal to the external interfaces, and it also needed an address for eg remote administration from the internet, VPN terminations, and so on.

    So that was one circumstances where, as far as I could determine, a bridge interface definitely needed an IP address of its own. Does that make sense?

    • 1

  3. Back in 2011 it may sound nonsense to assign IP address to a bridge interface, but nowadays in 2022 this technique is heavily used in routing traffic between containers (or network namespaces, to be more specific). See examples in Container Networking From Scratch and Linux Bridges, IP Tables, and CNI Plug-Ins - A Container Networking Deepdive. Basically, you connect veth pairs in different containers to a bridge interface, assign a subnet containing IP addresses of those veths to that bridge interface, and let the bridge interface do all the routings.

    By that, the containers form a software-defined LAN on a single machine, which is extremely flexible because you can change network topology simply by tweaking containers (in stead of real machines). Also, it's a very useful abstraction since containers are treated as if they are individual machines, so no more LAMP hassles.

    (It sounds more like a switch though, but since there's no equivalent abstraction of switches in kernel so here we are.)

    • 1