Network Bridges on Linux: When and How

A network bridge is a Layer 2 device that forwards traffic between multiple network interfaces based on MAC addresses. On Linux, bridges are the backbone of virtual networking. Every container runtime, every VPS hypervisor, and every software-defined network uses bridges to connect virtual interfaces to physical networks. Understanding how to create and manage bridges is not optional for anyone running virtualized workloads.

What a Bridge Actually Does

Think of a bridge as a virtual switch. When you create a bridge and attach interfaces to it, the kernel forwards frames between those interfaces as if they were plugged into the same Ethernet switch. The bridge learns MAC addresses dynamically. A frame arriving on one port is forwarded only to the port where the destination MAC was last seen. If the bridge does not know where the MAC is, it floods the frame to all ports except the source.

On a Linux VPS, a bridge typically connects a physical interface like eth0 with virtual TAP interfaces created by virtual machines or containers. The physical interface carries traffic to and from the internet, while the virtual interfaces connect individual guests or containers to the same Layer 2 segment.

Creating a Bridge with ip

The ip command from iproute2 can create bridges directly. This is the most direct method and works on any Linux system.

ip link add br0 type bridge
ip link set br0 up
ip addr add 10.0.0.1/24 dev br0
ip link set eth0 master br0
ip link set veth-vm1 master br0

The master keyword assigns an interface to the bridge. Once eth0 and veth-vm1 are both members of br0, they can communicate at Layer 2 as if they were on the same physical switch. The bridge itself holds the IP address for the host to communicate on that subnet.

Creating a Bridge with Netplan

On Ubuntu servers, Netplan is the preferred way to define bridges. The configuration is declarative and survives reboots.

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: false
  bridges:
    br0:
      interfaces:
        - eth0
      addresses:
        - 10.0.0.1/24
      routes:
        - to: default
          via: 10.0.0.1
      nameservers:
        addresses:
          - 1.1.1.1
      parameters:
        stp: true
        forward-delay: 4

Notice that eth0 has dhcp4 set to false. When an interface is a bridge member, it should not hold its own IP address. All IP configuration moves to the bridge device itself. The STP parameter enables Spanning Tree Protocol, which prevents bridge loops. On a simple two-port bridge, STP is not strictly necessary, but it is good practice.

Bridge Interfaces and STP

Spanning Tree Protocol prevents Layer 2 loops. If you accidentally create a loop by connecting two ports of the same bridge back together, STP detects it and blocks one of the ports. Without STP, a loop brings down the entire network segment in seconds as broadcast frames multiply endlessly.

brctl showstp br0
bridge link show

The brctl command comes from the bridge-utils package. On modern systems, the bridge subcommand of ip and the bridge link show command provide equivalent functionality without installing extra packages. Use these to inspect which ports are forwarding, which are blocked, and what the STP state of each port is.

Using Bridges for Containers

Container runtimes like Docker and Podman create their own bridges by default. Docker creates docker0 on installation and assigns each container a virtual ethernet pair, with one end in the container and the other end plugged into docker0. You can inspect this with standard tools.

ip link show type bridge
ip link show type veth
brctl show
docker network inspect bridge

Understanding this structure helps when containers cannot reach each other, when DNS resolution fails inside containers, or when you need to connect a container to a host-level VLAN. Instead of fighting Docker's default bridge, you create a custom bridge network and attach containers to it with explicit subnet assignments.

Bridge VLAN Filtering

Linux bridges support IEEE 802.1Q VLAN filtering. This allows you to assign VLAN tags to individual bridge ports, creating isolated network segments on the same physical infrastructure.

ip link set br0 type bridge vlan_filtering 1
bridge vlan add dev eth0 vid 100 pvid untagged
bridge vlan add dev veth-vm1 vid 100
bridge vlan show

VLAN filtering turns a simple bridge into a virtual switch with VLAN trunk and access ports. This is exactly what enterprise network switches do, except here it is all software-defined inside the Linux kernel.

Troubleshooting Bridges

When a bridge does not pass traffic, check three things. First, verify all member interfaces are up with ip link show. Second, check the MAC address table with bridge fdb show to confirm the kernel has learned the MAC addresses. Third, verify there are no iptables rules on the bridge device itself. The kernel has a bridge netfilter module that can intercept bridged traffic. If it is enabled, iptables rules on the physical interfaces might block Layer 2 frames.

bridge fdb show dev eth0
iptables -L -n -v -t filter
cat /proc/sys/net/bridge/bridge-nf-call-iptables

Setting bridge-nf-call-iptables to 0 disables the bridge firewall interaction and allows all bridged traffic to pass without going through iptables. This is often the fix when containers or VMs lose connectivity despite correct IP configuration.

You can experiment with bridges and virtual networking on a fresh VPS from Netbay in under 60 seconds at netbayhosts.in.