D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
usr
/
share
/
doc
/
bridge-utils-1.5
/
Filename :
HOWTO
back
Copy
Hello everybody, Although there is a man page which documents most of the actual commands, there is still a 'gap' concerning what bridges are, and how to set them up. This document attempts to fill this gap. In fact, this document is a 15-min hack, so feel free to {complain about,improve on} it. Especially if this document (or the FAQ) does not tell you what you want to know; I would consider that to be a bug. Have fun! Lennert Buytenhek <================= CUT HERE AND DAMAGE YOUR SCREEN =================> 1. The basics ------------- What does a bridge actually do? In plain English, a bridge connects two or more different physical ethernets together to form one large (logical) ethernet. The physical ethernets being connected together correspond to network interfaces in your linux box. The bigger (logical) ethernet corresponds to a virtual network interface in linux (often called br0, br1, br2, etc.) Let's say we want to tie eth0 and eth1 together, turning those networks into one larger network. What do we do? Well, we need to create an instance of the bridge first. # brctl addbr br0 (You can check that this gives you a network interface called br0.) Now we want to enslave eth0 and eth1 to this bridge. # brctl addif br0 eth0 # brctl addif br0 eth1 And now... because we connected the two ethernets together, they now form one large subnet. We are actually only on only one subnet, namely br0. We can forget about the fact that br0 is actually eth[01] in disguise; we will only deal with br0 from now on. Because we are only on one subnet, we only need one IP address for the bridge. This address we assign to br0. eth0 and eth1 should not have IP addresses allocated to them. # ifconfig eth0 0.0.0.0 # ifconfig eth1 0.0.0.0 # ifconfig br0 my.ip.address.here The last command also puts the interface br0 into the 'up' state. This will activate the forwarding of packets, which in plain English means that from that point on, eth0 and eth1 will be 'joined' together. Hosts on eth0 should 'see' hosts on eth1 and vice versa. The bridge will also (automatically) activate the Spanning Tree Protocol: this is a network protocol spoken by switches for (roughly speaking) calculating the shortest distances and eliminating loops in the topology of the network. You can disable the stp if you really want/need to; see brctl(8) for details. 2. More complicated setups -------------------------- We can create multiple bridge port groups and do filtering/NATting between them, just like we can do that with ordinary network interfaces. For example: on a quadport network card, dedicate two ports to a LAN on which we have IP 10.16.0.254, and the other two ports to a LAN on which we have IP 192.168.10.1 (this is an actual setup) # brctl addbr br_10 # brctl addif br_10 eth0 # brctl addif br_10 eth1 # ifconfig br_10 10.16.0.254 # brctl addbr br_192 # brctl addif br_192 eth2 # brctl addif br_192 eth3 # ifconfig br_192 192.168.10.1 You now have logical network interfaces br_10 and br_192, which will act just like ordinary interfaces. The only difference is that they each correspond to two physical network interfaces, but nobody cares about that. So.. for example, if 192.168.10.2 is the only host on the 192.* network that is allowed to access the 10.* network, we would do: ipchains -P forward REJECT ipchains -A forward -s 192.168.10.2/32 -d 10.0.0.0/8 -i br_10 -j ACCEPT (just like you were used to). Hope this helped. If not, send a cry for help to the mailing list.