Chapter 11. Configuring a network bridge
A network bridge is a link-layer device which forwards traffic between networks based on a table of MAC addresses. The bridge builds the MAC addresses table by listening to network traffic and thereby learning what hosts are connected to each network. For example, you can use a software bridge on a Red Hat Enterprise Linux 8 host to emulate a hardware bridge or in virtualization environments, to integrate virtual machines (VM) to the same network as the host.
A bridge requires a network device in each network the bridge should connect. When you configure a bridge, the bridge is called controller
and the devices it uses ports
.
You can create bridges on different types of devices, such as:
- Physical and virtual Ethernet devices
- Network bonds
- Network teams
- VLAN devices
Due to the IEEE 802.11 standard which specifies the use of 3-address frames in Wi-Fi for the efficient use of airtime, you cannot configure a bridge over Wi-Fi networks operating in Ad-Hoc or Infrastructure modes.
11.1. Configuring a network bridge using nmcli commands
This section explains how to configure a network bridge using the nmcli
utility.
Prerequisites
- Two or more physical or virtual network devices are installed on the server.
- To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server.
To use team, bond, or VLAN devices as ports of the bridge, you can either create these devices while you create the bridge or you can create them in advance as described in:
Procedure
Create a bridge interface:
#
nmcli connection add type bridge con-name bridge0 ifname bridge0
This command creates a bridge named
bridge0
, enter:Display the network interfaces, and note the names of the interfaces you want to add to the bridge:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet disconnected -- enp8s0 ethernet disconnected -- bond0 bond connected bond0 bond1 bond connected bond1 ...In this example:
-
enp7s0
andenp8s0
are not configured. To use these devices as ports, add connection profiles in the next step. -
bond0
andbond1
have existing connection profiles. To use these devices as ports, modify their profiles in the next step.
-
Assign the interfaces to the bridge.
If the interfaces you want to assign to the bridge are not configured, create new connection profiles for them:
#
nmcli connection add type ethernet slave-type bridge con-name bridge0-port1 ifname enp7s0 master bridge0
#nmcli connection add type ethernet slave-type bridge con-name bridge0-port2 ifname enp8s0 master bridge0
These commands create profiles for
enp7s0
andenp8s0
, and add them to thebridge0
connection.If you want to assign an existing connection profile to the bridge, set the
master
parameter of these connections tobridge0
:#
nmcli connection modify bond0 master bridge0
#nmcli connection modify bond1 master bridge0
These commands assign the existing connection profiles named
bond0
andbond1
to thebridge0
connection.
Configure the IP settings of the bridge. Skip this step if you want to use this bridge as a ports of other devices.
Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain of the
bridge0
connection, enter:#
nmcli connection modify bridge0 ipv4.addresses '192.0.2.1/24'
#nmcli connection modify bridge0 ipv4.gateway '192.0.2.254'
#nmcli connection modify bridge0 ipv4.dns '192.0.2.253'
#nmcli connection modify bridge0 ipv4.dns-search 'example.com'
#nmcli connection modify bridge0 ipv4.method manual
Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain of the
bridge0
connection, enter:#
nmcli connection modify bridge0 ipv6.addresses '2001:db8:1::1/64'
#nmcli connection modify bridge0 ipv6.gateway '2001:db8:1::fffe'
#nmcli connection modify bridge0 ipv6.dns '2001:db8:1::fffd'
#nmcli connection modify bridge0 ipv6.dns-search 'example.com'
#nmcli connection modify bridge0 ipv6.method manual
Optional: Configure further properties of the bridge. For example, to set the Spanning Tree Protocol (STP) priority of
bridge0
to16384
, enter:#
nmcli connection modify bridge0 bridge.priority '16384'
By default, STP is enabled.
Activate the connection:
#
nmcli connection up bridge0
Verify that the ports are connected, and the
CONNECTION
column displays the port’s connection name:#
nmcli device
DEVICE TYPE STATE CONNECTION ... enp7s0 ethernet connected bridge0-port1 enp8s0 ethernet connected bridge0-port2Red Hat Enterprise Linux activates controller and ports when the system boots. By activating any port connection, the controller is also activated. However, in this case, only one port connection is activated. By default, activating the controller does not automatically activate the ports. However, you can enable this behavior by setting:
Enable the
connection.autoconnect-slaves
parameter of the bridge connection:#
nmcli connection modify bridge0 connection.autoconnect-slaves 1
Reactivate the bridge:
#
nmcli connection up bridge0
Verification steps
Display the link status of Ethernet devices that are ports of a specific bridge:
#
ip link show master bridge0
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ffDisplay the status of Ethernet devices that are ports of any bridge device:
#
bridge link show
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100 5: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state forwarding priority 32 cost 100 6: enp11s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state blocking priority 32 cost 100 ...To display the status for a specific Ethernet device, use the
bridge link show dev ethernet_device_name
command.
Additional resources
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
-
For
nmcli
examples, see thenmcli-examples(7)
man page. -
For all bridge properties you can set, see the
bridge settings
section in thenm-settings(5)
man page. -
For all bridge port properties you can set, see the
bridge-port settings
section in thenm-settings(5)
man page. -
For details about the
bridge
utility, see thebridge(8)
man page. - If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
11.2. Configuring a network bridge using nm-connection-editor
This section explains how to configure a network bridge using the nm-connection-editor
application.
Note that nm-connection-editor
can add only new ports to a bridge. To use an existing connection profile as a port, create the bridge using the nmcli
utility as described in Section 11.1, “Configuring a network bridge using nmcli commands”.
Prerequisites
- Two or more physical or virtual network devices are installed on the server.
- To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server.
- To use team, bond, or VLAN devices as ports of the bridge, ensure that these devices are not already configured.
Procedure
Open a terminal, and enter
nm-connection-editor
:$
nm-connection-editor
- Click the button to add a new connection.
-
Select the
Bridge
connection type, and click . In the
Bridge
tab:-
Optional: Set the name of the bridge interface in the
Interface name
field. Click the
button to create a new connection profile for a network interface and adding the profile as a port to the bridge.-
Select the connection type of the interface. For example, select
Ethernet
for a wired connection. - Optionally, set a connection name for the port device.
-
If you create a connection profile for an Ethernet device, open the
Ethernet
tab, and select in theDevice
field the network interface you want to add as a port to the bridge. If you selected a different device type, configure it accordingly. - Click .
-
Select the connection type of the interface. For example, select
Repeat the previous step for each interface you want to add to the bridge.
-
Optional: Set the name of the bridge interface in the
- Optional: Configure further bridge settings, such as Spanning Tree Protocol (STP) options.
Configure the IP settings of the bridge. Skip this step if you want to use this bridge as a port of other devices.
In the
IPv4 Settings
tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain:In the
IPv6 Settings
tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain:
- Save the bridge connection.
-
Close
nm-connection-editor
.
Verification steps
Display the link status of Ethernet devices that are ports of a specific bridge.
#
ip link show master bridge0
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ffDisplay the status of Ethernet devices that are ports in any bridge device:
#
bridge link show
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100 5: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state forwarding priority 32 cost 100 6: enp11s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state blocking priority 32 cost 100 ...To display the status for a specific Ethernet device, use the
bridge link show dev ethernet_device_name
command.
Additional resources
- Section 13.6, “Configuring a network bond using nm-connection-editor”
- Section 12.7, “Configuring a network team using nm-connection-editor”
- Section 10.2, “Configuring VLAN tagging using nm-connection-editor”
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
11.3. Configuring a network bridge using RHEL System Roles
You can use the networking
RHEL System Role to configure a Linux bridge. This procedure describes how to configure a network bridge that uses two Ethernet devices, and sets IPv4 and IPv6 addresses, default gateways, and DNS configuration.
Set the IP configuration on the bridge and not on the ports of the Linux bridge.
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, this user has appropriatesudo
permissions on the managed node. - Two or more physical or virtual network devices are installed on the server.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/bridge-ethernet.yml
playbook with the following content:--- - name: Configure a network bridge that uses two Ethernet ports hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: # Define the bridge profile - name: bridge0 type: bridge interface_name: bridge0 ip: address: - "192.0.2.1/24" - "2001:db8:1::1/64" gateway4: 192.0.2.254 gateway6: 2001:db8:1::fffe dns: - 192.0.2.200 - 2001:db8:1::ffbb dns_search: - example.com state: up # Add an Ethernet profile to the bridge - name: bridge0-port1 interface_name: enp7s0 type: ethernet master: bridge0 slave_type: bridge state: up # Add a second Ethernet profile to the bridge - name: bridge0-port2 interface_name: enp8s0 type: ethernet master: bridge0 slave_type: bridge state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/bridge-ethernet.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/bridge-ethernet.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.