Bridging Concepts, Creating Bridges and Adding Ports

What it is

A bridge joins several interfaces into one Layer 2 network, so that they behave like ports on a switch.

Hosts on different ports of the bridge share one broadcast domain and one IP subnet. Frames are forwarded by MAC address, with no routing between the ports.

A RouterOS bridge is a virtual interface of its own. You add ports to it, and you put the IP address on the bridge, not on the member ports.

How it works

You create the bridge, add ports to it, and then address the bridge itself.

Bridge concepts

A bridge learns which MAC address lives behind which port. It records each source address it sees, and it uses that table to send later frames only to the right port.

Frames for an unknown destination, and broadcasts, are flooded out of every port of the bridge except the one they came from. This is the normal behaviour of a switch.

The learned addresses are kept in the host table of the bridge.

/interface bridge host print

Bridging works at Layer 2, while routing works at Layer 3. Interfaces in one bridge need no routes between them, and they share one subnet. Interfaces that are not bridged are separate networks that need routing between them.

Creating a bridge and adding ports

/interface bridge add name=bridge1
/interface bridge port add bridge=bridge1 interface=ether2
/interface bridge port add bridge=bridge1 interface=ether3
/ip address add address=192.168.88.1/24 interface=bridge1

The first command creates the bridge. The next two make ether2 and ether3 members. The last command puts the IP address on the bridge itself.

An interface can belong to only one bridge at a time. Once an interface is a bridge port, an IP address on that port stops being useful, because the bridge handles its traffic. Move the address to the bridge.

To check the result, print the bridge and its ports.

/interface bridge print
/interface bridge port print

Bridge settings

A few settings of the bridge are worth knowing.

The protocol mode matters when the network has loops. A loop makes frames circulate forever, so the bridge can run a spanning tree protocol that blocks redundant paths. RSTP is the usual choice on current versions, and it reacts faster than the older STP.

By default the bridge takes its MAC address from one of its ports. The admin-mac setting fixes it to a chosen address, which keeps the bridge address stable when ports change. Version 6 and version 7 differ in how bridge VLAN filtering is configured, so a VLAN design needs to follow the documentation for the installed version.

Bridge ports and the firewall

Each bridge port has its own settings, such as a path cost and priority for spanning tree. You will rarely need them for a simple LAN.

Traffic that is only switched between bridge ports does not go through the IP firewall by default. A bridge setting can send bridged traffic through the IP firewall as well, which is needed when you want filter rules to see it.

/interface bridge settings set use-ip-firewall=yes

A typical LAN bridge

A typical small office router bridges its LAN ports and any wireless interface into one bridge. The WAN port stays outside the bridge, because it is a separate network facing the provider.

The IP address, the DHCP server and the firewall rules for the LAN are then attached to the bridge interface. Adding a new LAN port later means only adding a bridge port.