---
title: Ethernet Bridging
canonical: https://openvpn.net/community-docs/ethernet-bridging/
product: Community Docs
description: Ethernet bridging combines an ethernet interface with one or more virtual TAP interfaces under a single bridge interface.
---

# Ethernet Bridging

**Ethernet bridging** essentially involves combining an ethernet interface with one or more virtual TAP interfaces and bridging them under the umbrella of a single bridge interface. Ethernet bridges represent the software analog to a physical ethernet switch. The ethernet bridge can be considered a kind of software switch that can be used to connect multiple ethernet interfaces (physical or virtual) on a single machine while sharing a single IP subnet.

By bridging a physical ethernet NIC with an OpenVPN-driven TAP interface at two separate locations, it is possible to logically merge both ethernet networks as if they were a single ethernet subnet.

## Bridging setup

This example will guide you in configuring an OpenVPN server-side ethernet bridge. Multiple clients can connect to the bridge, and each client's TAP interface will be assigned an IP address that is part of the server's LAN.

There are two methods for handling client IP address allocation:

1. Let OpenVPN manage its own client IP address pool using the **server-bridge** directive.
2. Configure the DHCP server on the LAN to also grant IP address leases to VPN clients.

In this example, we will use the first method, where the OpenVPN server manages its own IP address pool on the LAN subnet, separate from the pool used by the DHCP server (if one exists).

For our example, we will use these bridge settings:

| **Setting** | **bridge-start parameter** | **Value** |
| --- | --- | --- |
| Ethernet Interface | eth | eth0 |
| Local IP Address | ip | 192.168.8.4 |
| Local Netmask | eth\_netmask | 255.255.255.0 |
| Local Broadcast Address | eth\_broadcast | 192.168.8.255 |
| VPN client address pool |  | 192.168.8.128 to 192.168.8.254 |
| Virtual Bridge Interface | br | br0 |
| Virtual TAP Interface | tap | tap0 |

The first step is to follow the [How To](https://openvpn.net/community-docs/how-to.md) up to the "Starting up the VPN and testing for initial connectivity" section. Next, proceed below according to whether you are setting up the bridge on Linux or Windows.

## Bridge server on Linux

First, make sure you have the **bridge-utils** package installed.

Edit the [bridge-start](https://openvpn.net/community-docs/ethernet-bridging/#sample-scripts-bridge-start) script below. Set the **br**, **tap**, **eth**, **eth\_ip**, **eth\_netmask**, and **eth\_broadcast** parameters according to the physical ethernet interface you want to bridge. Make sure to use a private interface connected to a LAN protected from the internet by a firewall. You can use the Linux **ifconfig** command to get the necessary information about your network interfaces to fill in the **bridge-start** parameters.

Now run the **bridge-start** script. It will create a persistent **tap0** interface and bridge it with the active ethernet interface.

Next, we will edit the [OpenVPN server configuration file](https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/server.conf) to enable a bridging configuration.

Comment out the line that says **dev tun** and replace it instead with:

```
dev tap0
```

Comment out the line that begins with **server** and replace it with:

```
server-bridge 192.168.8.4 255.255.255.0 192.168.8.128 192.168.8.254
```

Now set up the Linux firewall to permit packets to flow freely over the newly created **tap0** and **br0** interfaces:

```
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
```

The OpenVPN bridge can now be started and stopped using this sequence:

1. Run **bridge-start**.
2. Run openvpn.
3. Stop openvpn.
4. Run **bridge-stop**.

At this point, the bridging-specific aspects of the configuration are complete, and you can continue [where you left off in the HOWTO](https://openvpn.net/community-docs/starting-up-the-vpn-and-testing-for-initial-connectivity.md).

## Bridge server on Windows XP

This configuration requires Windows XP or higher on the bridge side. To my knowledge, Windows 2000 does not support bridging. However, a Windows 2000 machine can be a client on a bridged network, where the other end of the OpenVPN connection where the bridging is occurring is a Linux or Windows XP machine.

When OpenVPN is installed on Windows, it automatically creates a single TAP-Win32 adapter, which will be assigned a name like "Local Area Connection 2". Go to the **Network Connections** control panel and rename it "tap-bridge".

Next, select **tap-bridge** and your ethernet adapter with the mouse, right-click, and select **Bridge Connections**. This will create a new **bridge adapter** icon in the control panel.

Set the TCP/IP properties on the bridge adapter to an IP of 192.168.8.4 and a [subnet mask](https://openvpn.net/as-docs/subnet-mask-cheat-sheet.md) of 255.255.255.0.

Next, edit the [OpenVPN server configuration file](https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/server.conf) to enable a bridging configuration.

Comment out the line which says **dev tun** and replace it instead with:

```
dev tap
dev-node tap-bridge
```

Comment out the line that begins with **server** and replace it with:

```
server-bridge 192.168.8.4 255.255.255.0 192.168.8.128 192.168.8.254
```

If you're running XP SP2, go to the firewall control panel and disable firewall filtering on the bridge and TAP adapters.

At this point, the bridging-specific aspects of the configuration are complete, and you can [continue where you left off in the HOWTO](https://openvpn.net/community-docs/starting-up-the-vpn-and-testing-for-initial-connectivity.md).

## Bridge client configuration

Use the [sample OpenVPN client configuration](https://openvpn.net/community-docs/implementing-a-load-balancing-failover-configuration.md) as a starting point. Comment out the line that says **dev tun** and replace it instead with:

```
dev tap
```

Finally, ensure that the client configuration file is consistent with the directives used in the server configuration. The major thing to check for is that the **proto** (udp or tcp) directives are consistent. Also, make sure that **comp-lzo** and **fragment**, if used, are present in both client and server config files.

## Ethernet bridging notes

When using an ethernet bridging configuration, the first step is to construct the ethernet bridge — a virtual network interface container for other ethernet interfaces, either real as in physical NICs or virtual as in TAP interfaces. The ethernet bridge interface must be set up before OpenVPN is actually started.

There is no portable method for generating an ethernet bridge interface — each OS has its own method (see below for examples).

OpenVPN may be started once the bridge interface has been created and appropriate ethernet interfaces have been added to it.

- A bridge interface is a virtual network interface formed by combining one or more ethernet interfaces, each of which may be a physical NIC or a virtual TAP interface used for VPN tunneling.
- When you set up an ethernet bridge, you should manually set the IP address and subnet of the bridge interface and not use an **ifconfig** directive in the OpenVPN config. This is because, unlike a TUN/TAP interface, OpenVPN cannot programmatically set a bridge interface's IP address and netmask.
- The OpenVPN config should specify the TAP interface component of the bridge interface in its **dev** directive, not the name of the bridge interface itself.
- On Windows, use the **dev-node** directive to name the TAP-Win32 adapter added to the bridge (the **dev-node** name refers to the adapter name shown in the **Network Connections** panel).
- On Linux/BSD/Unix, for the **dev tap** directive, use the explicit TUN/TAP unit number that you added to the bridge, such as **dev tap0**.
- If you are running OpenVPN in point-to-point mode, omit an **ifconfig** directive, and if you are using client/server mode, use the **server-bridge** directive on the server.
- You must manually set the TCP/IP settings on the bridge interface when bridging. For example, this can be done on Linux with an **ifconfig** command. In contrast, it can be done on Windows XP by setting the TCP/IP properties of the bridge interface in the **Network Connections** panel (the **Network Connections** panel on Windows XP and higher allows for point-and-click bridging).
- Ensure that only TAP interfaces are bridged with private ethernet interfaces protected behind a firewall. Never bridge a TAP interface with the same ethernet interface you use to connect to the internet, as that would create a potential security hole.
- The addresses used for **local** and **remote** should not be part of the bridged subnet — otherwise, you will end up with a routing loop.
- An important point to understand with Ethernet bridging is that each network interface added to the bridge will lose its individual identity in terms of specific settings such as IP address and netmask. Only the TCP/IP settings of the bridge interface itself will be relevant.
- A common mistake people make when manually configuring an Ethernet bridge is adding their primary ethernet adapter to the bridge before setting the IP and netmask of the bridge interface. The result is that the primary ethernet interface "loses" its settings. Still, the equivalent bridge interface settings have not yet been defined, so the net effect is a loss of connectivity on the ethernet interface.
- In most cases, it is possible to set up a usable bridge configuration with the ethernet bridge only configured on the server side, not the client side. If this is done, the client machines will become **multi-homed** when they connect to the server, i.e., they will still have their regular ethernet interface, but upon connection to the OpenVPN server, they will now have a new TAP interface bridged with the server's ethernet interface (and possibly all of the TAP interfaces of other connecting clients as well if the **client-to-client** directive is used on the server).

> **Note**
>
> **Notes — Ethernet bridging on Windows**
>
> The [Windows Notes page](https://openvpn.net/community-docs/the-standard-install-file-included-in-the-source-distribution.md) has additional information on ethernet bridging.

> **Note**
>
> **Notes — Ethernet bridging on Linux**
>
> The scripts below will handle bridge setup and shutdown on Linux. They are available in the **sample-scripts** subdirectory of the OpenVPN tarball.

## Sample scripts

### sample-scripts/bridge-start

```
#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.8.4"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.8.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
```

### sample-scripts/bridge-stop

```
#!/bin/bash

####################################
# Tear Down Ethernet bridge on Linux
####################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged together
tap="tap0"

ifconfig $br down
brctl delbr $br

for t in $tap; do
    openvpn --rmtun --dev $t
done
```

---

Prev: [Advanced Topics](https://openvpn.net/community-docs/advanced-topics.md)
Next: [Notes — Ethernet bridging, Windows client, Linux server](https://openvpn.net/community-docs/notes---ethernet-bridging-windows-client-linux-server.md)
Index: https://openvpn.net/community-docs/llms.txt