Bridge

This document describes how to configure a network bridge interface in Alpine Linux.

Using brctl

Bridges are manually managed with the brctl command.

Usage: brctl COMMAND [BRIDGE [INTERFACE]]

Manage ethernet bridges

Commands:
	show			Show a list of bridges
	addbr BRIDGE		Create BRIDGE
	delbr BRIDGE		Delete BRIDGE
	addif BRIDGE IFACE	Add IFACE to BRIDGE
	delif BRIDGE IFACE	Delete IFACE from BRIDGE
	setageing BRIDGE TIME		Set ageing time
	setfd BRIDGE TIME		Set bridge forward delay
	sethello BRIDGE TIME		Set hello time
	setmaxage BRIDGE TIME		Set max message age
	setpathcost BRIDGE COST		Set path cost
	setportprio BRIDGE PRIO		Set port priority
	setbridgeprio BRIDGE PRIO	Set bridge priority
	stp BRIDGE [1|0]		STP on/off

To manually create a bridge interface br0:

brctl addbr br0

To add interface eth0 and eth1 to the bridge br0:

brctl addif br0 eth0 brctl addif br0 eth1

Note that you need to set the link status to up on the added interfaces.

ip link set dev eth0 up ip link set dev eth1 up

Configuration file

Note: Alpine Linux v2.4 or newer is required for this

Install the scripts that configures the bridge.

apk add bridge

Bridging is then configured in /etc/network/interfaces with the bridge-ports keyword. Note that you normally don't assign ip addresses to the bridged interfaces (eth0 and eth1 in our example) but to the bridge itself (br0).

In this example the address 192.168.0.1/24 is used.

auto br0
iface br0 inet static
	bridge-ports eth0 eth1
	bridge-stp 0
	address 192.168.0.1
	netmask 255.255.255.0

You can set the various options with those keywords:

bridge-ports: Set bridge ports (ethX) or none for no physical interfaces
bridge-aging: Set ageing time
bridge-fd: Set bridge forward delay
bridge-hello: Set hello time
bridge-maxage: Set bridge max message age
bridge-pathcost: Set path cost
bridge-portprio: Set port priority
bridge-bridgeprio: Set bridge priority
bridge-stp: STP on/off

Using pre-up/post-down

For older versions of Alpine Linux, or if you want be able to control the bridge interfaces individually, you need to use pre-up/post-down hooks.

Example /etc/network/interfaces:

auto br0
iface br0 inet static
	pre-up brctl addbr br0
	pre-up echo 0 > /proc/sys/net/bridge/bridge-nf-call-arptables
	pre-up echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables
	pre-up echo 0 > /proc/sys/net/bridge/bridge-nf-call-ip6tables
	address 192.168.0.253
	netmask 255.255.255.0
	gateway 192.168.0.254
	post-down brctl delbr br0
	
auto eth0
iface eth0 inet manual
	up ip link set $IFACE up
	up brctl addif br0 $IFACE
	down brctl delif br0 $IFACE || true
	down ip link set $IFACE down
	
auto eth1
iface eth1 inet manual
	up ip link set $IFACE up
	up brctl addif br0 $IFACE
	down brctl delif br0 $IFACE || true
	down ip link set $IFACE down

That way you create br0 with: ifup br0, and you can add/remove individual interfaces to the bridge with ifup eth0, ifdown eth0.

Bridging for a Xen dom0

Bridging in a dom0 is a bit specific as it consists in bridging a real interface (i.e. ethX) with a virtual interface (i.e. vifX.Y). At bridge creation time, the virtual interface does not exist and will be added by the Xen toolstack when a domU is booting (see Xen documentation on how to link the virtual interface to the correct bridge).

Particularities

- the bridge consists of a single physical interface
- the physical interface does not have an IP and is configured as manual
- the bridge will have the IP and will be auto, resulting in bringing up the physical interface

This translates to this sample config :

Example /etc/network/interfaces:

auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
	address 192.168.0.253
	netmask 255.255.255.0
	gateway 192.168.0.254
        bridge_ports eth0
        bridge_stp 0

After the domU OS is started, the virtual interface wil be added and the working bridge can be checked with

brctl show

ifconfig -a

Bridging for KVM

Example /etc/network/interfaces:

Note: I personally remove the eth0 declaration without any issue.

auto br0
iface br0 inet dhcp
  bridge_ports eth0
  bridge_stp 0

Little script to allow dhcp over iptables

Note: I tried the Using pre-up/post-down as mentionned in #3 but it did'nt work well for me

Note: Usually it will be in /etc/rc.local as mentioned here

rc-update add local

cat >> /etc/local.d/iptables_dhcp_kvm.start << EOM
echo 0 > /proc/sys/net/bridge/bridge-nf-call-arptables
echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables
echo 0 > /proc/sys/net/bridge/bridge-nf-call-ip6tables
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
exit 0
EOM

cat >> /etc/local.d/iptables_dhcp_kvm.stop << EOM
exit 0
EOM

chmod +x /etc/local.d/iptables_dhcp_kvm.*