Ethernet-like networks (Ethernet, Ethernet over IP, IEEE802.11 in ap-bridge or bridge mode, WDS, VLAN) can be connected together using MAC bridges. The bridge feature allows the interconnection of hosts connected to separate LANs (using EoIP, geographically distributed networks can be bridged as well if any kind of IP network interconnection exists between them) as if they were attached to a single LAN. As bridges are transparent, they do not appear in traceroute list, and no utility can make a distinction between a host working in one LAN and a host working in another LAN if these LANs are bridged (depending on the way the LANs are interconnected, latency and data rate between hosts may vary).
Network loops may emerge (intentionally or not) in complex topologies. Without any special treatment, loops would prevent network from functioning normally, as they would lead to avalanche-like packet multiplication. Each bridge runs an algorithm which calculates how the loop can be prevented. STP and RSTP allows bridges to communicate with each other, so they can negotiate a loop free topology. All other alternative connections that would otherwise form loops, are put to standby, so that should the main connection fail, another connection could take its place. This algorithm exchanges configuration messages (BPDU - Bridge Protocol Data Unit) periodically, so that all bridges are updated with the newest information about changes in network topology. (R)STP selects a root bridge which is responsible for network reconfiguration, such as blocking and opening ports on other bridges. The root bridge is the bridge with the lowest bridge ID.
Bridge Interface Setup
Sub-menu:/interface bridge
To combine a number of networks into one bridge, a bridge interface should be created (later, all the desired interfaces should be set up as its ports). One MAC address will be assigned to all the bridged interfaces (the MAC address of first bridge port which comes up will be chosen automatically).
Properties
Property
Description
admin-mac (MAC address; Default:)
Static MAC address of the bridge (takes effect if auto-mac=no)
ageing-time (time; Default: 00:05:00)
How long a host's information will be kept in the bridge database
proxy-arp - the interface will use the ARP proxy feature
reply-only - the interface will only reply to requests originated from matching IP address/MAC address combinations which are entered as static entries in the "/ip arp" table. No dynamic entries will be automatically stored in the "/ip arp" table. Therefore for communications to be successful, a valid static entry must already exist.
auto-mac (yes | no; Default: yes)
Automatically select one MAC address of bridge ports as a bridge MAC address
forward-delay (time; Default: 00:00:15)
Time which is spent during the initialization phase of the bridge interface (i.e., after router startup or enabling the interface) in listening/learning state before the bridge will start functioning normally
How long to remember Hello messages received from other bridges
mtu (integer; Default: 1500)
Maximum Transmission Unit
name (text; Default: bridgeN)
Name of the bridge interface
priority (integer: 0..65535 decimal format or 0x0000-0xffff hex format; Default: 32768 / 0x8000)
Spanning tree protocol priority for bridge interface. Bridge with the smallest (lowest) bridge ID becomes a Root-Bridge. Bridge ID consists of two numbers - priority and MAC address of the bridge. To compare two bridge IDs, the priority is compared first. If two bridges have equal priority, then the MAC addresses are compared.
protocol-mode (none | rstp | stp; Default: rstp)
Select Spanning tree protocol (STP) or Rapid spanning tree protocol (RSTP) to ensure a loop-free topology for any bridged LAN. RSTP provides for faster spanning tree convergence after a topology change.
transmit-hold-count (integer: 1..10; Default: 6)
The Transmit Hold Count used by the Port Transmit state machine to limit transmission rate
Set port as edge port or non-edge port, or enable automatic detection. Edge ports are connected to a LAN that has no other bridges attached. If the port is configured to discover edge port then as soon as the bridge detects a BPDU coming to an edge port, the port becomes a non-edge port.
external-fdb (auto | no | yes; Default: auto)
Whether to use wireless registration table to speed up bridge host learning
The bridge firewall implements packet filtering and thereby provides security functions that are used to manage data flow to, from and through bridge.
Packet flow diagram shows how packets are processed through router. It is possible to force bridge traffic to go through /ip firewall filter rules (see: Bridge Settings)
There are two bridge firewall tables:
filter - bridge firewall with three predefined chains:
input - filters packets, where the destination is the bridge (including those packets that will be routed, as they are destined to the bridge MAC address anyway)
output - filters packets, which come from the bridge (including those packets that has been routed normally)
forward - filters packets, which are to be bridged (note: this chain is not applied to the packets that should be routed through the router, just to those that are traversing between the ports of the same bridge)
nat - bridge network address translation provides ways for changing source/destination MAC addresses of the packets traversing a bridge. Has two built-in chains:
srcnat - used for "hiding" a host or a network behind a different MAC address. This chain is applied to the packets leaving the router through a bridged interface
dstnat - used for redirecting some packets to other destinations
You can put packet marks in bridge firewall (filter and NAT), which are the same as the packet marks in IP firewall put by '/ip firewall mangle'. In this way, packet marks put by bridge firewall can be used in 'IP firewall', and vice versa.
General bridge firewall properties are described in this section. Some parameters that differ between nat and filter rules are described in further sections.
Properties
Property
Description
802.3-sap (integer)
DSAP (Destination Service Access Point) and SSAP (Source Service Access Point) are 2 one byte fields, which identify the network protocol entities which use the link layer service. These bytes are always equal. Two hexadecimal digits may be specified here to match a SAP byte
802.3-type (integer)
Ethernet protocol type, placed after the IEEE 802.2 frame header. Works only if 802.3-sap is 0xAA (SNAP - Sub-Network Attachment Point header). For example, AppleTalk can be indicated by SAP code of 0xAA followed by a SNAP type code of 0x809B
arp-dst-address (IP address; default: )
ARP destination address
arp-dst-mac-address (MAC address; default: )
ARP destination MAC address
arp-gratuitous (yes | no; default: )
Matches ARP gratuitous packets
arp-hardware-type (integer; default: 1)
ARP hardware type. This is normally Ethernet (Type 1)
drarp-error - Dynamic RARP error code, saying that an IP address for the given MAC address can not be allocated
drarp-reply - Dynamic RARP reply, with a temporaty IP address assignment for a host
drarp-request - Dynamic RARP request to assign a temporary IP address for the given MAC address
inarp-reply - InverseARP Reply
inarp-request - InverseARP Request
reply - standard ARP reply with a MAC address
reply-reverse - reverse ARP (RARP) reply with an IP address assigned
request - standard ARP request to a known IP address to find out unknown MAC address
request-reverse - reverse ARP (RARP) request to a known MAC address to find out unknown IP address (intended to be used by hosts to find out their own IP address, similarly to DHCP service)
arp-packet-type (integer: 0..65535 decimal format or 0x0000-0xffff hex format)
ARP Packet Type
arp-src-address (IP address; default: )
ARP source address
arp-src-mac-address (MAC address; default: )
ARP source MAC address
chain (text)
Bridge firewall chain, which the filter is functioning in (either a built-in one, or a user defined)
dst-address (IP address; default: )
Destination IP address (only if MAC protocol is set to IPv4)
dst-mac-address (MAC address; default: )
Destination MAC address
dst-port (integer 0..65535)
Destination port number or range (only for TCP or UDP protocols)
in-bridge (name)
Bridge interface through which the packet is coming in
in-interface (name)
Physical interface (i.e., bridge port) through which the packet is coming in
ingress-priority (integer 0..63)
Matches ingress priority of the packet. Priority may be derived from VLAN, WMM or MPLS EXP bit. read more»
other-host - packet is destined to some other unicast address, not to the bridge itself
src-address (IP address; default: )
Source IP address (only if MAC protocol is set to IPv4)
src-mac-address (MAC address; default: )
Source MAC address
src-port (integer 0..65535)
Source port number or range (only for TCP or UDP protocols)
stp-flags (topology-change | topology-change-ack)
The BPDU (Bridge Protocol Data Unit) flags. Bridge exchange configuration messages named BPDU periodically for preventing loops
topology-change - topology change flag is set when a bridge detects port state change, to force all other bridges to drop their host tables and recalculate network topology
topology-change-ack - topology change acknowledgement flag is sen in replies to the notification packets
stp-forward-delay (time 0..65535)
Forward delay timer
stp-hello-time (time 0..65535)
STP hello packets time
stp-max-age (time 0..65535)
Maximal STP message age
stp-msg-age (time 0..65535)
STP message age
stp-port (integer 0..65535)
STP port identifier
stp-root-address (MAC address)
Root bridge MAC address
stp-root-cost (integer 0..65535)
Root bridge cost
stp-root-priority (integer 0..65535)
Root bridge priority
stp-sender-address (MAC address)
STP message sender MAC address
stp-sender-priority (integer 0..65535)
STP sender priority
stp-type (config | tcn)
The BPDU type:
config - configuration BPDU
tcn - topology change notification
vlan-encap (802.2 | arp | ip | ipv6 | ipx | length | mpls-multicast | mpls-unicast | pppoe | pppoe-discovery | rarp | vlan or integer: 0..65535 decimal format or 0x0000-0xffff hex format)
the MAC protocol type encapsulated in the VLAN frame
vlan-id (integer 0..4095)
VLAN identifier field
vlan-priority (integer 0..7)
The user priority field
Notes
STP matchers are only valid if destination MAC address is 01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF (Bridge Group address), also stp should be enabled.
ARP matchers are only valid if mac-protocol is arp or rarp
VLAN matchers are only valid for vlan ethernet protocol
IP-related matchers are only valid if mac-protocol is set as ipv4
802.3 matchers are only consulted if the actual frame is compliant with IEEE 802.2 and IEEE 802.3 standards (note: it is not the industry-standard Ethernet frame format used in most networks worldwide!). These matchers are ignored for other packets.
Bridge Packet Filter
Sub-menu:/interface bridge filter
This section describes bridge packet filter specific filtering options, that are specific to '/interface bridge filter'.
accept - accept the packet. No action, i.e., the packet is passed through without undertaking any action, and no more rules are processed in the relevant list/chain
drop - silently drop the packet (without sending the ICMP reject message)
jump - jump to the chain specified by the value of the jump-target argument
log - ladd a message to the system log containing following data: in-interface, out-interface, src-mac, dst-mac, eth-proto, protocol, src-ip:port->dst-ip:port and length of the packet. After packet is matched it is passed to next rule in the list, similar as passthrough
mark - mark the packet to use the mark later
passthrough - ignore this rule and go on to the next one. Acts the same way as a disabled rule, except for ability to count packets
return - return to the previous chain, from where the jump took place
set-priority - set priority specified by the new-priority parameter on the packets sent out through a link that is capable of transporting priority (VLAN or WMM-enabled wireless interface). Read more>
Bridge NAT
Sub-menu:/interface bridge nat
This section describes bridge NAT options, that are specific to '/interface bridge nat'.
accept - accept the packet. No action, i.e., the packet is passed through without undertaking any action, and no more rules are processed in the relevant list/chain
arp-reply - send a reply to an ARP request (any other packets will be ignored by this rule) with the specified MAC address (only valid in dstnat chain)
drop - silently drop the packet (without sending the ICMP reject message)
dst-nat - change destination MAC address of a packet (only valid in dstnat chain)
jump - jump to the chain specified by the value of the jump-target argument
log - log the packet
mark - mark the packet to use the mark later
passthrough - ignore this rule and go on to the next one. Acts the same way as a disabled rule, except for ability to count packets
redirect - redirect the packet to the bridge itself (only valid in dstnat chain)
return - return to the previous chain, from where the jump took place
set-priority - set priority specified by the new-priority parameter on the packets sent out through a link that is capable of transporting priority (VLAN or WMM-enabled wireless interface). Read more>
src-nat - change source MAC address of a packet (only valid in srcnat chain)
to-arp-reply-mac-address (MAC address)
Source MAC address to put in Ethernet frame and ARP payload, when action=arp-reply is selected
to-dst-mac-address (MAC address)
Destination MAC address to put in Ethernet frames, when action=dst-nat is selected
to-src-mac-address (MAC address)
Source MAC address to put in Ethernet frames, when action=src-nat is selected
