Linux bridges operate at layer 2 and therefore can only switch packets between interfaces whose mac addresses are contained in a single bridge; a full router operates at layer 3, and thus allows packets to be forwarded/routed to other networks.

Considering this, from a security standpoint, is the reason one would use a linux bridge to limit which systems can communicate with one another?

I've read the tag description of this, but it's still a little bit unclear.

4 Answers 4


The bridge / switch concept wasn't created as a security solution. Its main goal was to alleviate the problem that arises when there is a high number of devices attached to a single ethernet network.

When ethernet networks were a bunch of hubs together you could have hundreds of workstations sharing the same collision domain and the same broadcast domain.

As more stations you have in a single collision domain, the chances of transmitting without collisions is lower, and the results are: more retransmissions and a perception of slow network.

A bridge divides the network in a number of collision domains equal to the number of ports the bridge has and maintaining a single broadcast domain.

The result is less collisions for the same number of workstations, improving the general speed of the network.

The ultimate bridge is the switch, where each workstation is inside its own collision domain, letting the workstations to use full duplex (because as there are not collisions, the workstation can transmit and receive simultaneously).



Bridges were not originally designed as security devices but as a method of helping networks to scale by splitting up collision domains.

However the bridge support in linux is more than just a bridge. Bridge traffic passes through ebtables and by default IP traffic on a bridge passes through iptables (this can be disabled). This allows one to implement packet filtering and can therefore allow a firewall to be introduced without breaking up the layer-2 domain.


  • What do you mean by "without breaking up a layer-2 domain" and what would be the advantage of not doing that?
    – leeand00
    Commented May 13, 2016 at 15:13
  • Normally firewalls are implemented as a "filtering router". That means that you can't easilly pass non-ip traffic and means that if you want to insert a firewall retroactively you will usually end up renumbering stuff. A "filtering bridge" on the other hand can filter traffic without any need for network renumbering and can pass non-ip traffic if desired. Commented May 13, 2016 at 15:23

Packets are layer 3 items. Frames are layer 2 items. Routers route packets and bridges/switches pass frames.

Internet Protocol (IP) = layer 3. If your endpoints have no ip addresses, they are no accessible by endpoints beyond their layer 2 domain.

So, a VLAN is a virtual LAN, or a segregated out bridge/switch - virtually. That could be considered a security feature.


Short answer: No.

The choice to use a bridge or router depends much more on the topology design, type of media used, physical distance, cost, etc.

There may be security benefits to create isolated layer 2 networks, but that is still more of a topological decision.

Not the answer you're looking for? Browse other questions tagged or ask your own question.