Chapter 6. Configuring a network bridge A network bridge is a link-layer device which forwards traffic between networks based on a table of MAC addresses. The bridge builds the MAC addresses table by listening to network traffic and thereby learning what hosts are connected to each network. For example, you can use a software bridge on a Red Hat Enterprise Linux host to emulate a hardware bridge or in virtualization environments, to integrate virtual machines (VM) to the same network as the host. A bridge requires a network device in each network the bridge should connect. When you configure a bridge, the bridge is called controller and the devices it uses ports . You can create bridges on different types of devices, such as: Physical and virtual Ethernet devices Network bonds Network teams VLAN devices Due to the IEEE 802.11 standard which specifies the use of 3-address frames in Wi-Fi for the efficient use of airtime, you cannot configure a bridge over Wi-Fi networks operating in Ad-Hoc or Infrastructure modes. 6.1. Configuring a network bridge by using nmcli To configure a network bridge on the command line, use the nmcli utility. Prerequisites Two or more physical or virtual network devices are installed on the server. The host runs on Red Hat Enterprise Linux 9.4 or later. This version introduced the port-type , controller , connection.autoconnect-ports options used in this procedure. RHEL versions instead use slave-type , master , and connection.autoconnect-slaves . To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server. To use team, bond, or VLAN devices as ports of the bridge, you can either create these devices while you create the bridge or you can create them in advance as described in: Configuring a network team by using nmcli Configuring a network bond by using nmcli Configuring VLAN tagging by using nmcli Procedure Create a bridge interface: This command creates a bridge named bridge0 , enter: Display the network interfaces, and note the names of the interfaces you want to add to the bridge: In this example: enp7s0 and enp8s0 are not configured. To use these devices as ports, add connection profiles in the step. bond0 and bond1 have existing connection profiles. To use these devices as ports, modify their profiles in the step. Assign the interfaces to the bridge. If the interfaces you want to assign to the bridge are not configured, create new connection profiles for them: These commands create profiles for enp7s0 and enp8s0 , and add them to the bridge0 connection. If you want to assign an existing connection profile to the bridge: Set the controller parameter of these connections to bridge0 : These commands assign the existing connection profiles named bond0 and bond1 to the bridge0 connection. Reactivate the connections: Configure the IPv4 settings: If you plan to use this bridge device as a port of other devices, enter: To use DHCP, no action is required. To set a static IPv4 address, network mask, default gateway, and DNS server to the bridge0 connection, enter: Configure the IPv6 settings: If you plan to use this bridge device as a port of other devices, enter: To use stateless address autoconfiguration (SLAAC), no action is required. To set a static IPv6 address, network mask, default gateway, and DNS server to the bridge0 connection, enter: Optional: Configure further properties of the bridge. For example, to set the Spanning Tree Protocol (STP) priority of bridge0 to 16384 , enter: By default, STP is enabled. Activate the connection: Verify that the ports are connected, and the CONNECTION column displays the port's connection name: When you activate any port of the connection, NetworkManager also activates the bridge, but not the other ports of it. You can configure that Red Hat Enterprise Linux enables all ports automatically when the bridge is enabled: Enable the connection.autoconnect-ports parameter of the bridge connection: Reactivate the bridge: Verification Use the ip utility to display the link status of Ethernet devices that are ports of a specific bridge: Use the bridge utility to display the status of Ethernet devices that are ports of any bridge device: To display the status for a specific Ethernet device, use the bridge link show dev <ethernet_device_name> command. Additional resources bridge(8) and nm-settings(5) man pages on your system NetworkManager duplicates a connection after restart of NetworkManager service (Red Hat Knowledgebase) How to configure a bridge with VLAN information? (Red Hat Knowledgebase) 6.2. Configuring a network bridge by using the RHEL web console Use the RHEL web console to configure a network bridge if you prefer to manage network settings using a web browser-based interface. Prerequisites Two or more physical or virtual network devices are installed on the server. To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server. To use team, bond, or VLAN devices as ports of the bridge, you can either create these devices while you create the bridge or you can create them in advance as described in: Configuring a network team using the RHEL web console Configuring a network bond by using the RHEL web console Configuring VLAN tagging by using the RHEL web console You have installed the RHEL 9 web console. You have enabled the cockpit service. Your user account is allowed to log in to the web console. For instructions, see Installing and enabling the web console . Procedure Log in to the RHEL 9 web console. For details, see Logging in to the web console . Select the Networking tab in the navigation on the left side of the screen. Click Add bridge in the Interfaces section. Enter the name of the bridge device you want to create. Select the interfaces that should be ports of the bridge. Optional: Enable the Spanning tree protocol (STP) feature to avoid bridge loops and broadcast radiation. Click Apply . By default, the bridge uses a dynamic IP address. If you want to set a static IP address: Click the name of the bridge in the Interfaces section. Click Edit to the protocol you want to configure. Select Manual to Addresses , and enter the IP address, prefix, and default gateway. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers. In the DNS search domains section, click the + button, and enter the search domain. If the interface requires static routes, configure them in the Routes section. Click Apply Verification Select the Networking tab in the navigation on the left side of the screen, and check if there is incoming and outgoing traffic on the interface: 6.3. Configuring a network bridge by using nmtui The nmtui application provides a text-based user interface for NetworkManager. You can use nmtui to configure a network bridge on a host without a graphical interface. Note In nmtui : Navigate by using the cursor keys. Press a button by selecting it and hitting Enter . Select and clear checkboxes by using Space . To return to the screen, use ESC . Prerequisites Two or more physical or virtual network devices are installed on the server. To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server. Procedure If you do not know the network device names on which you want configure a network bridge, display the available devices: Start nmtui : Select Edit a connection , and press Enter . Press Add . Select Bridge from the list of network types, and press Enter . Optional: Enter a name for the NetworkManager profile to be created. On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile. Enter the bridge device name to be created into the Device field. Add ports to the bridge to be created: Press Add to the Slaves list. Select the type of the interface you want to add as port to the bridge, for example, Ethernet . Optional: Enter a name for the NetworkManager profile to be created for this bridge port. Enter the port's device name into the Device field. Press OK to return to the window with the bridge settings. Figure 6.1. Adding an Ethernet device as port to a bridge Repeat these steps to add more ports to the bridge. Depending on your environment, configure the IP address settings in the IPv4 configuration and IPv6 configuration areas accordingly. For this, press the button to these areas, and select: Disabled , if the bridge does not require an IP address. Automatic , if a DHCP server or stateless address autoconfiguration (SLAAC) dynamically assigns an IP address to the bridge. Manual , if the network requires static IP address settings. In this case, you must fill further fields: Press Show to the protocol you want to configure to display additional fields. Press Add to Addresses , and enter the IP address and the subnet mask in Classless Inter-Domain Routing (CIDR) format. If you do not specify a subnet mask, NetworkManager sets a /32 subnet mask for IPv4 addresses and /64 for IPv6 addresses. Enter the address of the default gateway. Press Add to DNS servers , and enter the DNS server address. Press Add to Search domains , and enter the DNS search domain. Figure 6.2. Example of a bridge connection without IP address settings Press OK to create and automatically activate the new connection. Press Back to return to the main menu. Select Quit , and press Enter to close the nmtui application. Verification Use the ip utility to display the link status of Ethernet devices that are ports of a specific bridge: Use the bridge utility to display the status of Ethernet devices that are ports of any bridge device: To display the status for a specific Ethernet device, use the bridge link show dev <ethernet_device_name> command. 6.4. Configuring a network bridge by using nm-connection-editor If you use Red Hat Enterprise Linux with a graphical interface, you can configure network bridges using the nm-connection-editor application. Note that nm-connection-editor can add only new ports to a bridge. To use an existing connection profile as a port, create the bridge using the nmcli utility as described in Configuring a network bridge by using nmcli . Prerequisites Two or more physical or virtual network devices are installed on the server. To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server. To use team, bond, or VLAN devices as ports of the bridge, ensure that these devices are not already configured. Procedure Open a terminal, and enter nm-connection-editor : Click the + button to add a new connection. Select the Bridge connection type, and click Create . On the Bridge tab: Optional: Set the name of the bridge interface in the Interface name field. Click the Add button to create a new connection profile for a network interface and adding the profile as a port to the bridge. Select the connection type of the interface. For example, select Ethernet for a wired connection. Optional: Set a connection name for the port device. If you create a connection profile for an Ethernet device, open the Ethernet tab, and select in the Device field the network interface you want to add as a port to the bridge. If you selected a different device type, configure it accordingly. Click Save . Repeat the step for each interface you want to add to the bridge. Optional: Configure further bridge settings, such as Spanning Tree Protocol (STP) options. Configure the IP address settings on both the IPv4 Settings and IPv6 Settings tabs: If you plan to use this bridge device as a port of other devices, set the Method field to Disabled . To use DHCP, leave the Method field at its default, Automatic (DHCP) . To use static IP settings, set the Method field to Manual and fill the fields accordingly: Click Save . Close nm-connection-editor . Verification Use the ip utility to display the link status of Ethernet devices that are ports of a specific bridge. Use the bridge utility to display the status of Ethernet devices that are ports in any bridge device: To display the status for a specific Ethernet device, use the bridge link show dev ethernet_device_name command. Additional resources Configuring a network bond by using nm-connection-editor Configuring a network team by using nm-connection-editor Configuring VLAN tagging by using nm-connection-editor Configuring NetworkManager to avoid using a specific profile to provide a default gateway How to configure a bridge with VLAN information? (Red Hat Knowledgebase) 6.5. Configuring a network bridge by using nmstatectl Use the nmstatectl utility to configure a network bridge through the Nmstate API. The Nmstate API ensures that, after setting the configuration, the result matches the configuration file. If anything fails, nmstatectl automatically rolls back the changes to avoid leaving the system in an incorrect state. Depending on your environment, adjust the YAML file accordingly. For example, to use different devices than Ethernet adapters in the bridge, adapt the base-iface attribute and type attributes of the ports you use in the bridge. Prerequisites Two or more physical or virtual network devices are installed on the server. To use Ethernet devices as ports in the bridge, the physical or virtual Ethernet devices must be installed on the server. To use team, bond, or VLAN devices as ports in the bridge, set the interface name in the port list, and define the corresponding interfaces. The nmstate package is installed. Procedure Create a YAML file, for example ~/create-bridge.yml , with the following content: --- interfaces: - name: bridge0 type: linux-bridge state: up ipv4: enabled: true address: - ip: 192.0.2.1 prefix-length: 24 dhcp: false ipv6: enabled: true address: - ip: 2001:db8:1::1 prefix-length: 64 autoconf: false dhcp: false bridge: options: stp: enabled: true port: - name: enp1s0 - name: enp7s0 - name: enp1s0 type: ethernet state: up - name: enp7s0 type: ethernet state: up routes: config: - destination: 0.0.0.0/0 -hop-address: 192.0.2.254 -hop-interface: bridge0 - destination: ::/0 -hop-address: 2001:db8:1::fffe -hop-interface: bridge0 dns-resolver: config: search: - example.com server: - 192.0.2.200 - 2001:db8:1::ffbb These settings define a network bridge with the following settings: Network interfaces in the bridge: enp1s0 and enp7s0 Spanning Tree Protocol (STP): Enabled Static IPv4 address: 192.0.2.1 with the /24 subnet mask Static IPv6 address: 2001:db8:1::1 with the /64 subnet mask IPv4 default gateway: 192.0.2.254 IPv6 default gateway: 2001:db8:1::fffe IPv4 DNS server: 192.0.2.200 IPv6 DNS server: 2001:db8:1::ffbb DNS search domain: example.com Apply the settings to the system: Verification Display the status of the devices and connections: Display all settings of the connection profile: Display the connection settings in YAML format: Additional resources nmstatectl(8) man page on your system /usr/share/doc/nmstate/examples/ directory How to configure a bridge with VLAN information? (Red Hat Knowledgebase) 6.6. Configuring a network bridge by using the network RHEL system role You can connect multiple networks on layer 2 of the Open Systems Interconnection (OSI) model by creating a network bridge. To configure a bridge, create a connection profile in NetworkManager. By using Ansible and the network RHEL system role, you can automate this process and remotely configure connection profiles on the hosts defined in a playbook. You can use the network RHEL system role to configure a bridge and, if a connection profile for the bridge's parent device does not exist, the role can create it as well. Note If you want to assign IP addresses, gateways, and DNS settings to a bridge, configure them on the bridge and not on its ports. Prerequisites You have prepared the control node and the managed nodes You are logged in to the control node as a user who can run playbooks on the managed nodes. The account you use to connect to the managed nodes has sudo permissions on them. Two or more physical or virtual network devices are installed on the server. Procedure Create a playbook file, for example ~/playbook.yml , with the following content: --- - name: Configure the network hosts: managed-node-01.example.com tasks: - name: Bridge connection profile with two Ethernet ports ansible.builtin.include_role: name: rhel-system-roles.network vars: network_connections: # Bridge profile - name: bridge0 type: bridge interface_name: bridge0 ip: dhcp4: yes auto6: yes state: up # Port profile for the 1st Ethernet device - name: bridge0-port1 interface_name: enp7s0 type: ethernet controller: bridge0 port_type: bridge state: up # Port profile for the 2nd Ethernet device - name: bridge0-port2 interface_name: enp8s0 type: ethernet controller: bridge0 port_type: bridge state: up The settings specified in the example playbook include the following: type: <profile_type> Sets the type of the profile to create. The example playbook creates three connection profiles: One for the bridge and two for the Ethernet devices. dhcp4: yes Enables automatic IPv4 address assignment from DHCP, PPP, or similar services. auto6: yes Enables IPv6 auto-configuration. By default, NetworkManager uses Router Advertisements. If the router announces the managed flag, NetworkManager requests an IPv6 address and prefix from a DHCPv6 server. For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node. Validate the playbook syntax: Note that this command only validates the syntax and does not protect against a wrong but valid configuration. Run the playbook: Verification Display the link status of Ethernet devices that are ports of a specific bridge: Display the status of Ethernet devices that are ports of any bridge device: Additional resources /usr/share/ansible/roles/rhel-system-roles.network/README.md file /usr/share/doc/rhel-system-roles/network/ directory

Commands:
nmcli connection add type bridge con-name bridge0 ifname bridge0
nmcli device status DEVICE TYPE STATE CONNECTION enp7s0 ethernet disconnected -- enp8s0 ethernet disconnected -- bond0 bond connected bond0 bond1 bond connected bond1
nmcli connection add type ethernet port-type bridge con-name bridge0-port1 ifname enp7s0 controller bridge0 nmcli connection add type ethernet port-type bridge con-name bridge0-port2 ifname enp8s0 controller bridge0
nmcli connection modify bond0 controller bridge0 nmcli connection modify bond1 controller bridge0
nmcli connection up bond0 nmcli connection up bond1
nmcli connection modify bridge0 ipv4.method disabled
nmcli connection modify bridge0 ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253' ipv4.dns-search 'example.com' ipv4.method manual
nmcli connection modify bridge0 ipv6.method disabled
nmcli connection modify bridge0 ipv6.addresses '2001:db8:1::1/64' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd' ipv6.dns-search 'example.com' ipv6.method manual
nmcli connection modify bridge0 bridge.priority '16384'
nmcli connection up bridge0
nmcli device DEVICE TYPE STATE CONNECTION enp7s0 ethernet connected bridge0-port1 enp8s0 ethernet connected bridge0-port2
nmcli connection modify bridge0 connection.autoconnect-ports 1
nmcli connection up bridge0
ip link show master bridge0 3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ff
bridge link show 3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100 5: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state forwarding priority 32 cost 100 6: enp11s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state blocking priority 32 cost 100
nmcli device status DEVICE TYPE STATE CONNECTION enp7s0 ethernet unavailable -- enp8s0 ethernet unavailable --
nmtui
ip link show master bridge0 3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ff
bridge link show 3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100
nm-connection-editor
ip link show master bridge0 3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ff
bridge link show 3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100 5: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state forwarding priority 32 cost 100 6: enp11s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state blocking priority 32 cost 100
--- interfaces: - name: bridge0 type: linux-bridge state: up ipv4: enabled: true address: - ip: 192.0.2.1 prefix-length: 24 dhcp: false ipv6: enabled: true address: - ip: 2001:db8:1::1 prefix-length: 64 autoconf: false dhcp: false bridge: options: stp: enabled: true port: - name: enp1s0 - name: enp7s0 - name: enp1s0 type: ethernet state: up - name: enp7s0 type: ethernet state: up routes: config: - destination: 0.0.0.0/0 next-hop-address: 192.0.2.254 next-hop-interface: bridge0 - destination: ::/0 next-hop-address: 2001:db8:1::fffe next-hop-interface: bridge0 dns-resolver: config: search: - example.com server: - 192.0.2.200 - 2001:db8:1::ffbb
nmstatectl apply ~/create-bridge.yml
nmcli device status DEVICE TYPE STATE CONNECTION bridge0 bridge connected bridge0
nmcli connection show bridge0 connection.id: bridge0_ connection.uuid: e2cc9206-75a2-4622-89cf-1252926060a9 connection.stable-id: -- connection.type: bridge connection.interface-name: bridge0
nmstatectl show bridge0
--- - name: Configure the network hosts: managed-node-01.example.com tasks: - name: Bridge connection profile with two Ethernet ports ansible.builtin.include_role: name: rhel-system-roles.network vars: network_connections: # Bridge profile - name: bridge0 type: bridge interface_name: bridge0 ip: dhcp4: yes auto6: yes state: up # Port profile for the 1st Ethernet device - name: bridge0-port1 interface_name: enp7s0 type: ethernet controller: bridge0 port_type: bridge state: up # Port profile for the 2nd Ethernet device - name: bridge0-port2 interface_name: enp8s0 type: ethernet controller: bridge0 port_type: bridge state: up
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m command -a 'ip link show master bridge0' managed-node-01.example.com | CHANGED | rc=0 >> 3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ff
ansible managed-node-01.example.com -m command -a 'bridge link show' managed-node-01.example.com | CHANGED | rc=0 >> 3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100