Two building blocks underlie most non-trivial Linux networking: bridges, which are software switches, and VLANs, which let one cable carry several separate networks.

Bridges

A bridge is a switch implemented in the kernel. Interfaces added to it become ports, and frames are forwarded between them based on MAC address.

The common use is giving virtual machines addresses on your real network rather than behind NAT.

# Create the bridge
sudo ip link add name br0 type bridge
sudo ip link set br0 up

# Add the physical interface as a port
sudo ip link set eth0 master br0

# Move the address to the bridge
sudo ip addr flush dev eth0
sudo ip addr add 192.168.1.10/24 dev br0
sudo ip route add default via 192.168.1.1

The address must move. Once eth0 is a bridge port it is a switch port, not an endpoint, so an address on it does nothing. Leaving it there is the most common reason a freshly created bridge kills connectivity, and doing this over SSH without console access is how people lock themselves out of a machine.

Inspecting:

bridge link show
ip -br link show type bridge
bridge fdb show br br0        # the MAC forwarding table

Then a libvirt guest attached to br0 appears on your LAN with its own address from your normal DHCP server.

Wireless does not bridge

Most wireless drivers reject frames whose source MAC is not the interface’s own, which is precisely what a bridge needs to do. For VMs on a laptop, use libvirt’s default NAT network instead.

VLANs

A VLAN tag is a small field in the Ethernet header identifying which logical network a frame belongs to. One physical link can therefore carry several networks that cannot see each other.

# Create VLAN 10 on eth0
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip link set eth0.10 up
sudo ip addr add 10.10.10.5/24 dev eth0.10

sudo ip -d link show eth0.10     # confirm the VLAN id

The switch must agree. A tagged frame arriving on a port configured for a single untagged VLAN is dropped, and the failure is silent. Configure the switch port as a trunk carrying the VLANs you want, and this is where most VLAN troubleshooting time actually goes.

Access port carries one untagged VLAN; the device knows nothing about tagging.

Trunk port carries several tagged VLANs, which is what a virtualization host wants.

Combining them

The arrangement most homelabs end up with: a trunk from the switch, VLAN interfaces on the host, and a bridge per VLAN so guests can be placed on whichever network they belong to.

# VLAN interfaces on the trunk
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip link add link eth0 name eth0.20 type vlan id 20

# A bridge per VLAN
sudo ip link add name br-vlan10 type bridge
sudo ip link add name br-vlan20 type bridge
sudo ip link set eth0.10 master br-vlan10
sudo ip link set eth0.20 master br-vlan20
sudo ip link set br-vlan10 up
sudo ip link set br-vlan20 up

Now a guest on br-vlan20 sits on your IoT network and cannot reach the machines on VLAN 10, enforced by the switch rather than by host firewall rules.

Making it persist

Everything above disappears at reboot. Persist it with your distribution’s network manager.

systemd-networkd, in /etc/systemd/network/:

# 10-br0.netdev
[NetDev]
Name=br0
Kind=bridge

# 20-eth0.network
[Match]
Name=eth0

[Network]
Bridge=br0

# 30-br0.network
[Match]
Name=br0

[Network]
Address=192.168.1.10/24
Gateway=192.168.1.1
DNS=192.168.1.1

NetworkManager handles both through nmcli, and Netplan on Ubuntu generates configuration for whichever backend is in use.

Testing without losing the machine

Bridge and VLAN changes disconnect you when they go wrong, and they go wrong more often than most network changes.

Before touching a remote machine, confirm you have console access. Or schedule a safety net:

# Revert in 5 minutes unless you cancel it
sudo shutdown -r +5 "network change safety reboot"
# then, once it works:
sudo shutdown -c

That single habit has saved a great many trips to a data centre.

Frequently Asked Questions

What is a Linux bridge?

A software network switch inside the kernel. Interfaces added to it become ports on that switch, and frames are forwarded between them based on MAC addresses. It is what lets virtual machines appear directly on the physical network.

What does a VLAN actually do?

It adds a tag to each Ethernet frame identifying which logical network it belongs to, so one physical link can carry several separate networks that cannot see each other. The switch and the host both have to agree on the tags.

Why does my VM get no network on a bridge?

Commonly because the physical interface still holds the IP address. When you bridge an interface, the address must move to the bridge itself, since the physical port becomes a switch port rather than an endpoint.

Can I bridge a wireless interface?

Usually not. Most wireless drivers reject frames with a source MAC other than the interface’s own, which is exactly what bridging requires. Use routed networking with NAT for VMs on a laptop instead.

What is the difference between an access port and a trunk?

An access port carries one untagged VLAN, so the device attached knows nothing about tagging. A trunk carries several tagged VLANs, which is what you configure on the switch port feeding a virtualization host.

Do I need to configure the switch as well as the host?

For VLANs, yes. Tagged frames arriving on a switch port configured for a single untagged VLAN are dropped. The host and the switch must agree, and mismatched configuration is the usual cause of a VLAN that silently does not work.