Updated: 3 November 2026 · Applies to: Debian, using ifupdown and bridge-utils
To set up a network bridge on Debian, install bridge-utils and ifupdown, then define the bridge in a network interfaces file. Debian 12 and later no longer install ifupdown by default, pushing instead toward netplan, so install it explicitly first if you want to manage networking the traditional way shown here.
Install the tools
apt install -y ifupdown bridge-utils
Find your physical interface name
ip -br link
Note the name of the real network interface, for example eth0 or enp1s0; you will reference it below.
Create the bridge configuration
Keep the bridge's own config in its own file under /etc/network/interfaces.d/ rather than editing the main interfaces file directly:
vi /etc/network/interfaces.d/br0
For a bridge with a static IP:
auto br0
iface br0 inet static
address 192.168.2.23
netmask 255.255.255.0
gateway 192.168.2.254
bridge_ports eth0
bridge_stp off
bridge_waitport 0
bridge_fd 0
Or, for a bridge that should get its address from DHCP instead:
auto br0
iface br0 inet dhcp
bridge_ports eth0
bridge_ports lists the physical interface (or interfaces, space separated) the bridge actually carries traffic over. Replace eth0 with the real interface name you found above.
Make sure the main interfaces file only has loopback
Remove any existing config for the physical interface from the main file so it does not conflict with the bridge taking it over:
cat /etc/network/interfaces
It should contain only the loopback interface and a line sourcing the directory you just added a file to:
auto lo iface lo inet loopback source /etc/network/interfaces.d/*
Restart networking
Disable the firewall first if it references the old interface name directly, so you are not locked out, then restart networking:
systemctl restart networking
Confirm the bridge came up:
ip addr show br0 ip route
Check its member ports and spanning tree status with bridge-utils:
brctl show
Or with the newer iproute2 equivalent:
bridge link
Once you have confirmed br0 is up and routing correctly, update any firewall rules that referenced the old physical interface name to reference br0 instead.
