Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Linux bridges operate at layer 2 and therefore can only switch packets between interfaces whose mac addresses are contained in a single bridge; a full router operates at layer 3, and thus allows packets to be forwarded/routed to other networks.
Considering this, from a security standpoint, is the reason one would use a linux bridge to limit which systems can communicate with one another?
I've read the tag description of this, but it's still a little bit unclear.
The bridge / switch concept wasn't created as a security solution. Its main goal was to alleviate the problem that arises when there is a high number of devices attached to a single ethernet network.
When ethernet networks were a bunch of hubs together you could have hundreds of workstations sharing the same collision domain and the same broadcast domain.
As more stations you have in a single collision domain, the chances of transmitting without collisions is lower, and the results are: more retransmissions and a perception of slow network.
A bridge divides the network in a number of collision domains equal to the number of ports the bridge has and maintaining a single broadcast domain.
The result is less collisions for the same number of workstations, improving the general speed of the network.
The ultimate bridge is the switch, where each workstation is inside its own collision domain, letting the workstations to use full duplex (because as there are not collisions, the workstation can transmit and receive simultaneously).
Yes,
Bridges were not originally designed as security devices but as a method of helping networks to scale by splitting up collision domains.
However the bridge support in linux is more than just a bridge. Bridge traffic passes through ebtables and by default IP traffic on a bridge passes through iptables (this can be disabled). This allows one to implement packet filtering and can therefore allow a firewall to be introduced without breaking up the layer-2 domain.
Packets are layer 3 items. Frames are layer 2 items. Routers route packets and bridges/switches pass frames.
Internet Protocol (IP) = layer 3. If your endpoints have no ip addresses, they are no accessible by endpoints beyond their layer 2 domain.
So, a VLAN is a virtual LAN, or a segregated out bridge/switch - virtually. That could be considered a security feature.
Short answer: No.
The choice to use a bridge or router depends much more on the topology design, type of media used, physical distance, cost, etc.
There may be security benefits to create isolated layer 2 networks, but that is still more of a topological decision.
