On Ubuntu, it is common to use Netplan to attach an Ethernet interface to a Linux bridge. On Rocky Linux 9, however, NetworkManager typically manages networking.

Instead of Netplan, Rocky Linux uses nmcli to create a bridge and attach the physical network interface to it.

This article explains how to achieve the equivalent of an Ubuntu Netplan bridge configuration on Rocky Linux 9.

Network Topology

For example, if your wired network interface is:

eth0

Enter fullscreen mode Exit fullscreen mode

the final configuration will look like this:

          DHCP Server
               │
        Ethernet Switch
               │
             eth0
               │
         Linux Bridge
             br0
               │
      IP Address (DHCP)
               │
         hostapd (AP)
               │
        Wi-Fi Clients

Enter fullscreen mode Exit fullscreen mode

With this configuration:

  • The physical NIC becomes a member port of the bridge.
  • The bridge (br0) owns the IP address.
  • hostapd is attached to the bridge.
  • Wi-Fi clients join the same Layer 2 network as the wired LAN.

Create the Bridge

First, create the bridge.

sudo nmcli connection add \
    type bridge \
    ifname br0 \
    con-name br0

Enter fullscreen mode Exit fullscreen mode

Preserve the Bridge MAC Address

Depending on the environment, a newly created bridge may receive a different MAC address.

To preserve the existing network identity, configure the bridge to use the same MAC address as the original Ethernet interface.

sudo nmcli connection modify br0 \
    bridge.mac-address xx:xx:xx:xx:xx:xx

Enter fullscreen mode Exit fullscreen mode

Configure DHCP on the Bridge

The bridge—not the physical NIC—should obtain the IP address.

sudo nmcli connection modify br0 \
    ipv4.method auto \
    ipv6.method disabled

Enter fullscreen mode Exit fullscreen mode

Add the Ethernet Interface to the Bridge 

sudo nmcli connection add \
    type bridge-slave \
    ifname eth0 \
    master br0

Enter fullscreen mode Exit fullscreen mode

If an existing Ethernet connection profile already exists, delete or disable it.

nmcli connection show

sudo nmcli connection delete "<existing-profile-name>"

Enter fullscreen mode Exit fullscreen mode

Activate the Bridge

Bring the bridge online.

sudo nmcli connection up br0

Enter fullscreen mode Exit fullscreen mode

Verify the configuration.

ip addr show br0

bridge link

Enter fullscreen mode Exit fullscreen mode

The expected state is:

  • eth0 is attached as master br0.
  • br0 owns the IP address.
  • DHCP runs on br0.
  • The bridge uses the same MAC address as the original Ethernet interface.

Why Preserve the MAC Address?

When a bridge is created, it may be assigned a new MAC address.

If the MAC address changes:

  • The DHCP server may recognize the system as a different device.
  • A new DHCP lease may be assigned.
  • MAC address–based access control may no longer work as expected.
  • Neighboring devices may need to refresh their ARP caches.

To minimize the impact on the existing network, configure the bridge to use the same MAC address as the original NIC.

bridge.mac-address xx:xx:xx:xx:xx:xx

Enter fullscreen mode Exit fullscreen mode

Using the Bridge with hostapd

After creating the bridge, specify it in hostapd.conf.

interface=wlp2s0
bridge=br0

Enter fullscreen mode Exit fullscreen mode

This allows:

  • Wired LAN devices
  • Wi-Fi clients
  • The DHCP server

to operate on the same Layer 2 network, enabling Wi-Fi clients to obtain IP addresses directly from the existing DHCP server.

The Configuration Persists Across Reboots

A bridge created with nmcli is not a temporary configuration.

NetworkManager stores connection profiles as .nmconnection files under:

/etc/NetworkManager/system-connections/

Enter fullscreen mode Exit fullscreen mode

These profiles are automatically restored after a reboot.

For example, running:

sudo nmcli connection add type bridge ifname br0 con-name br0

Enter fullscreen mode Exit fullscreen mode

creates a configuration file similar to:

/etc/NetworkManager/system-connections/br0.nmconnection

Enter fullscreen mode Exit fullscreen mode

Bridge slave connections are stored in the same way.

Using nmcli is therefore the standard method for creating persistent bridge configurations.

By contrast, a bridge created only with the ip command:

ip link add br0 type bridge

Enter fullscreen mode Exit fullscreen mode

is temporary and disappears after a reboot.

Precautions When Reconfiguring Over SSH

Ubuntu's Netplan provides:

sudo netplan try

Enter fullscreen mode Exit fullscreen mode

which temporarily applies a configuration and automatically rolls it back if connectivity is lost.

NetworkManager does not provide an equivalent automatic rollback mechanism.

When changing network settings over SSH, it is recommended to:

  • Ensure you have access to an out-of-band management console such as IPMI or iLO.
  • Use tmux or screen to reduce the risk of losing your session.
  • Verify that the bridge is functioning correctly before deleting the original connection profile.

Netplan and NetworkManager Comparison

Netplan NetworkManager (nmcli)
bridges: type bridge
interfaces: bridge-slave
dhcp4: true ipv4.method auto
dhcp6: false ipv6.method disabled
macaddress: bridge.mac-address
netplan apply nmcli connection up br0
netplan try No equivalent feature

Summary

On Rocky Linux 9, you can use NetworkManager's nmcli to build the same bridge configuration that is commonly implemented with Netplan on Ubuntu.

The key points are:

  • Assign the IP address to the bridge rather than the physical NIC.
  • Configure the bridge to use the same MAC address as the original Ethernet interface.
  • Point hostapd to the bridge.
  • Bridge configurations created with nmcli are persistent across reboots.
  • Unlike Netplan, NetworkManager does not provide an automatic rollback feature similar to netplan try, so exercise caution when making network changes over SSH.

With this setup, wired LAN devices and Wi-Fi clients share the same Layer 2 network, allowing Wi-Fi clients to obtain IP addresses directly from the existing DHCP server.