Bridge two ports#

You will end up with two or more ports in one layer-2 segment, sharing one address. The usual reasons are a router with more ports than segments, and a spare port used as a one-device switch.

Before you start#

• The operator role and a licence.
• A session that does not arrive on any port you are bridging, or a console. Moving an address onto a bridge takes it off the port it was on, which ends a session using it.

Step 1 — Free the ports#

A port that has an address, or already belongs to a bridge or a bond, cannot join a bridge, and the page does not offer it. If one of the ports carries the address the segment uses, open it on Network → Interfaces, remove the address from Addresses and press Save changes. Do not apply yet: the address goes onto the bridge in the same set of changes.

Step 2 — Create the bridge#

Network → Interfaces → Add interface, type Bridge.

1. Name is filled in with the next free one, br0.
2. Member ports: pick each port from the list.
3. Spanning tree: turn it on if the bridge could ever form a loop with a switch — two of its ports cabled to the same switch, say.
4. Address: the address the segment uses, such as 192.0.2.1/24.

Press Add interface, then Apply with auto-revert in the Commit Bar: this changes which interface carries an address, and auto-revert puts the old configuration back if you lose the router.

Step 3 — Move everything that named a port#

Anything that referred to a member port by name now needs to refer to the bridge.

Missing one of these is the usual reason a bridge "does not work": the segment is fine and one rule still names a port that no longer has an address.

Changing the ports later#

Open the bridge on Interfaces. Under Bridge, Member ports lists its ports: remove one with its ×, or add one from the list. Spanning tree turns spanning tree on or off.

When the bridge carries VLANs, a port added here carries them too, so a network on the bridge reaches the new port like the others. The field says so.

VLANs on the bridge#

A network can be added to a bridge like any port. The Networks page turns VLANs on for the bridge, allows the network's VLAN on every port, and exempts the router's own VLAN traffic on bridges from the firewall's state policy, which would otherwise drop the router's side of every conversation on the VLAN. Adding a VLAN from Interfaces → Add interface does the same.

Check it worked#

Interfaces shows the bridge with its link state and counters, and its ports under Member ports. A bridge with no address means step 2 was not applied; a port with no traffic is usually a cable.

Then, from a device on each port, reach the router's address. Both ports should reach it, and each other.

Undoing it#

Open the bridge and press Delete interface twice, put the address back on the port from its own panel, and change back everything from step 3, all before applying.

See also#

• Add a network (VLAN)
• Bond two ports
• Adding an interface
• The interface panel