Set up a virtual bridge

Peter Boy, Kevin Fenzi Version F44 Last review: 2026-04-28

A bridge establishes a specific communication network between the network interfaces of multiple devices. It sorts traffic based on the hardware-related MAC addresses of the interface rather than the environment- and customisation-related IP addresses. A virtual bridge implements this functionality as a software application on a server rather than in dedicated hardware. In most cases, the devices connected are virtual machines or containers running on the host providing the virtual bridge. However, physical interfaces can also be attached.

Status: Awaiting final review. For now, just take it all with a grain of salt.

Basically there are two types of usage.

The bridge adds a new interface and its own IP address. This option is typically used to create one or more internal, secure network(s).
The bridge shares an existing interface and takes over a physical interface and its IP address from the host. This option is typically used to connect the server along with hosted VMs and maybe other physical connected devices to an external network.

More complex configurations are also possible, such as setting up an internal local network of several servers that use one or more additional physical interfaces. But the basic structure of a virtual bridge remains the same.

Prerequisites

Fully updated Fedora Server, any version of F33 or newer. F44 is preferred.
All physical interfaces are fully configured and operational

Steps to configure a virtual bridge

The bridge needs a unique name to be able to make a connection. It is helpful to use a descriptive name about its function, for example vbrint or vbr1s0 for an internal network or a replacement of enp1s0.

Use case: Adding a new interface and network

We use the name vbrint here. In the same step we add an appropriate IP address and network specification.

Create a bridge

$ sudo nmcli con add con-name vbrint ifname vbrint type bridge stp off

Modify network specifications as appropriate.

Specifically, adjust the zone to your requirements. If you specify no zone, the bridge is assigned to the default zone, FedoraServer. This is probably not a good idea in the case of an internal, secure network.
```
$ sudo nmcli con mod vbrint connection.zone internal \
ipv4.method manual \
ipv4.addresses '192.158.xxx.yy/24'  \
ipv4.gateway '192.158.yyy.zz' \
ipv4.dns '192.158.yyy.zz' \
ipv6.method disabled
```
If there is no gateway or no DNS configured yet, exclude that part of the configuration.

If you use an IPv6 network you must specify the correct network configuration information, instead of disabling it.
Bring the bridge up
```
$ sudo nmcli con up vbrint
```

Use case: Replacing an existing interface and network

We use the name vbr1s0 to denote the replacement of the physical interface known as 'enp1s0'.

Create the bridge

$ sudo nmcli con add type bridge con-name vbr1s0 ifname vbr1s0 stp off

Modify network specifications as appropriate.

In this scenario the bridge takes over the connection from the interface enp1s0. You will therefore need to import the IP configuration into the bridge. (The connection configuration enp1s0 will be deleted later; only the device will remain, integrated into the bridge.)

Retrieve the current connection specifications.

$ sudo nmcli -f ipv4.method,ipv4.addresses,ipv4.gateway,ipv4.dns,ipv6.method,ipv6.addresses,ipv6.gateway,ipv6.dns con show enp1s0
ipv4.method:                            auto
ipv4.addresses:                         --
ipv4.gateway:                           --
ipv4.dns:                               --
ipv6.method:                            auto
ipv6.addresses:                         --
ipv6.gateway:                           --
ipv6.dns:                               --

Set these details in the Bridge (vir1s0)

$ sudo nmcli con mod vbr1s0
ipv4.method manual
ipv4.addresses '192.158.xxx.yy/24'  \
ipv4.gateway '192.158.yyy.zz' \
ipv4.dns '192.158.yyy.zz' \
ipv6.method manual \
ipv6.addresses 'uu:vv:ww:xx::yy.zz/64'  \
ipv6.gateway 'uu:vv:ww:xx::yy.zz' \
ipv6.dns 'uu:vv:ww:xx::yy.zz' \
ipv6.addr-gen-mode eui64 \
connection.zone FedoraServer

Adjust the zone to your requirements. If no zone is specified, the bridge is assigned to the default zone (FedoraServer), which is probably OK for an external interface.

Add the existing interface as a secondary (bridge-slave) to the bridge configuration

$ sudo nmcli con add type bridge-slave ifname enp1s0 master vbr1s0 con-name vbr1s0-sl

Transfer connection

Disconnect from the current connection named enp1s0 and enable the bridge. Use command concatenation (&&) to avoid losing the connection.

$ sudo nmcli con down enp1s0 && nmcli con up vbr1s0

NetworkManager replaces the connection enp1s0, not the device.

$ nmcli con
NAME       UUID                                  TYPE      DEVICE
vbr1s0     a4fef065-...-75786a74d495  bridge    vbr1s0
vbr1s0-sl  b626163c-...-4c9f6477dd16  ethernet  enp1s0
lo         9aef9261-...-7f88d3ad3ecb  loopback  lo

$ nmcli dev
DEVICE   TYPE       STATE                   CONNECTION
vbr1s0   bridge     connected               vbr1s0
enp1s0   ethernet   connected               vbr1s0-sl
lo       loopback   connected (externally)  lo

Optionally: Delete the earlier enp1s0 connection configuration

You can delete the connection to avoid any further confusion.
```
$ sudo nmcli con del enp1s0
```

Add interfaces to the bridge

The virtual machine and containerization tools provide means to select an network interface of the host to connect them to. As an example, when you instantiate a virtual machine image by using virt-install, you include a line similar to the following in the command:

 --network bridge=vbrint,model=virtio

Cockpit provides you with a list of available interfaces on the host to connect the virtual machine to.

Physical interfaces must be active. They are added as a port to the bridge.

$ sudo nmcli con mod enp2s0 master vbr1s0

Follow-up tasks

Manage forwarding

If the host has more than one network interface, you will probably want traffic to be automatically forwarded between the interfaces. Check the forwarding status:

$ cat /proc/sys/net/ipv4/ip_forward
$ cat /proc/sys/net/ipv6/conf/default/forwarding

In both cases, a value of 1 indicates that automatic forwarding is enabled. Otherwise, it is disabled. This is the default. If necessary, you can enable forwarding immediately and temporarily.

$ echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
$ echo 1 | sudo tee /proc/sys/net/ipv6/conf/all/forwarding

To make these changes permanent, create or edit the file at /etc/sysctl.d/50-enable-forwarding.conf by using your preferred editor running under sudo:

# local customizations
#
# enable forwarding for dual stack
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

Install DHCP and DNS

It is often desirable to provide DHCP and, where necessary, DNS within a bridge’s subnet. For Fedora servers, dnsmasq is the recommended solution for this.