I am attempting to set up my Raspberry Pi as a bridge, using Debian wheezy. I have a hostapd.conf: (some details changed for security, and yes, I know WEP is no good)...


And this in /etc/network/interfaces:

auto lo

iface lo inet loopback
iface eth0 inet dhcp

allow-hotplug wlan0
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
iface default inet dhcp
auto br0
iface br0 inet dhcp
bridge-ports eth0 wlan0

Everything seems to come up ok, but I cannot associate with the bridged wireless connection - even though the flashing lights on the USB stick suggest packets are being exchanged.

I have read somewhere that not all cards/devices will run in hostap mode - they won't pass packets in one direction: is that right? (The info was a bit old)- this my card:

[    3.663245] usb 1-1.3.1: new high-speed USB device number 5 using dwc_otg
[    3.794187] usb 1-1.3.1: New USB device found, idVendor=0cf3, idProduct=9271
[    3.804321] usb 1-1.3.1: New USB device strings: Mfr=16, Product=32, SerialNumber=48
[    3.816994] usb 1-1.3.1: Product: USB2.0 WLAN
[    3.823790] usb 1-1.3.1: Manufacturer: ATHEROS
[    3.830645] usb 1-1.3.1: SerialNumber: 12345

So, what have I got wrong here?

Update: So I have done further investigations and can get the bridge up, but seemingly that destroys the (wired) ethernet connection, which is odd. E.g., on the RPi:

Boot the system...


(router) - this works

Attempt to associate with wireless LAN ... fails (or rather "with limited connectivity" on Android phone - no good)

brctl showmacs br0

This just shows mac of wlan0 and mac of phone at this point

brctl addif br0 eth0 wlan0

At this point I can now associate the phone with the wireless network, but...



And similarly I can no longer ping the RasPi from any other machine on the network


ifconfig br0

Suggests the bridge is dropping packets...

Any ideas?

Further update: The /etc/network/interfaces file now (and for the above sequence) reads:

auto lo eth0

iface lo inet loopback
iface eth0 inet dhcp

allow-hotplug wlan0
#wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
iface default inet dhcp
  • This is definitely on-topic for Super User, so no worries. Good luck with the bounty, I'm curious to know what the answer is as well. Dec 18, 2012 at 21:45
  • What does iw dev wlan0 info show? And Googling on your device ID shows you need a recent kernel or wireless modules for running this device in AP mode. See this. What kernel and ath9k driver are you running?
    – gertvdijk
    Dec 20, 2012 at 0:10
  • See also this answer. Jul 20, 2017 at 12:02

5 Answers 5


Bridges made easy:

There is a project on sourceforge made just for your situation. http://sourceforge.net/projects/bridger/ It even comes as a deb package.

With regard to 'dropping' packets:

  1. Did you check to see if iptables is set to default drop? sudo iptables --list should say "ACCEPT, ACCEPT, ACCEPT" for a box of this type. If that's the issue turn it off.

  2. Are you even forwarding the packets, bro? Make sure the line "net.ipv4.ip_forward=1" is NOT commented in /etc/sysctl.conf (it is by default), then restart your networking.

  3. Promiscuous mode is not supported by your wireless dongle. (meaning it can't accept packets that are not destined for it)

Pure Bridge vs. Shared Bridge:

  1. iface br0 inet dhcp indicates a shared bridge, meaning that the bridge itself gets an ip and can be an endpoint for traffic.

  2. A pure bridge does not get an ip address and only forwards traffic between the two interfaces

  3. Shared Bridge Sample /etc/network/interfaces config file (Debian/Ubuntu)

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# Bridge between eth0 and wlan0
auto br0
iface br0 inet dhcp
  pre-up ip link set eth0 down
  pre-up ip link set wlan0 down
  pre-up brctl addbr br0
  pre-up brctl addif br0 eth0 wlan0
  pre-up ip addr flush dev eth0
  pre-up ip addr flush dev wlan0
  post-down ip link set eth0 down
  post-down ip link set wlan0 down
  post-down ip link set br0 down
  post-down brctl delif br0 eth0 wlan0
  post-down brctl delbr br0

Restart the network: sudo /etc/init.d/networking restart After making complex network configuration changes its easier to just reboot rather than make sure everything restarted properly in the reboot.

You think you have routing issues:

  1. Eliminate DNS as a cause by testing with ping If this works, then you probably have a DNS issue in your network.

  2. Check your gateway with sudo ip route hopefully you see default via dev br0 proto dhcp (assuming your gateway is If it's missing or wrong, fix it sudo ip route add default via Test again: ping

  3. Renew your shared bridge ip with dhclient br0 and retest with ping

  4. Check your 'slave' interfaces with ifconfig and make sure eth0 and wlan0 do NOT have ip addresses. They are a part of the bridge now. If they do, make sure you remove them from all the config files, set them to static or something.

If NONE of this works, try that debian bridging app, and if that doesn't work then your wireless dongle doesn't support promiscuous mode. (see above)

If it works at any time here, reboot and make sure it still works.

  • Please see the latest update for the interfaces file and, yes, all the chains are set to ACCEPT Dec 18, 2012 at 23:04
  • These instructions work, at least in the sense if I apply dhclient br0 and specify the eth0 is locked down to, now just have to work out how to make it automatic :) Dec 20, 2012 at 23:44
  • OK, I have it up and running with a bit of jiggery pokery via rc.local scripts (essentially I have to restart hostapd) - so you get the bounty. But now my squid server on the same box is failing - but I did not ask you about that, so it will have to be another question. Dec 21, 2012 at 0:27
  • Squid question now at superuser.com/questions/522332/… Dec 21, 2012 at 0:38
  • What are the eth0 and wlan0 settings in this example? Specifically, how do you set the SSID and any authentication for wlan0?
    – Ian
    Jan 22, 2014 at 23:11

I have some wireless bridges working on Debian Linux and Openwrt, so I am very familiar with this issue.

You missed one important command: You forgot to tell your wireless driver to transmit 4-address frames (sometimes improperly/historically called WDS), which is required for 802.11/wireless bridging. Do this with the command "iw dev wlan0 set 4addr on". Use a "pre-up" statement in your Debian interfaces file on the bridge to apply it before bringing up the bridge. Note that 4-address frame mode requires driver support and some old crappy 802.11 drivers or hardware may not support it.

I also strongly suspect your problems may have been complicated by a bug in the Linux kernel which specifically affects bridged interfaces. I ran into this bug myself and had to compile my own wpa_supplicant from sources because the version in Debian is old and affected. wpa_supplicant and hostapd share a common code base, but I'm not completely sure that this affected hostapd as well as wpa_supplicant.

There is a work-around commit to the issue here:


I am under the impression this is in the 2.5 release, and I know it's in the current 2.6 source. The current Debian version is 2.4, which is broken. Please pester the Debian project to update their wpasupplicant and hostapd packages.

Here is a sample config for a wireless bridge client using WPA/WPA2 with a wireless bridge between interfaces wlan0 and eth0, with the host getting a DHCP address on the br0 interface (replace "dhcp" with "manual" for no IP address). For a situation where you want to be the AP, include the interface= and bridge= commands in hostapd.conf and omit the wpa-* commands below.

In your /etc/network/interfaces file:

allow-auto br0
iface br0 inet dhcp
    bridge_ports wlan0 eth0
    bridge_stp off
    bridge_waitport 5
    bridge_fd 0
    wpa-ssid mynetwork
    wpa-psk abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123
    wpa-iface wlan0
    wpa-bridge br0
    pre-up iw dev wlan0 set 4addr on
    post-down iw dev wlan0 set 4addr off

And make sure your wpa_supplicant is version 2.5 or later. It won't work with wpa_supplicant 2.4 and current kernel versions.

I should also note that there is currently a race bug in ifup where bridge interfaces may fail to come up at boot time, but that's a whole other issue.

  • This fixed the problem for me with OpenWRT. I had to change both the WiFi client and the access point to have WDS mode enabled. When WDS/4addr wasn't enabled on the client I couldn't add it to the bridge device with brctl, and when it was enabled I got no traffic bridged until WDS/4addr was enabled on the AP as well. This is because WiFi doesn't send the source MAC address (assuming all packets originate from the AP) but bridging requires the original source MAC. 4addr/WDS adds this extra data to each packet to enable bridging.
    – Malvineous
    Oct 21, 2021 at 16:44

You seem to need ip forwarding.

try cat /proc/sys/net/ipv4/ip_forward

If it's 0 issue: echo 1 > /proc/sys/net/ipv4/ip_forward

  • 3
    sys.net.ipv4.ip_forward is for IPv4 routing, NAT, etc. Bridges works one layer below in the network stack. Jul 20, 2017 at 11:57

Bridging can only work when an interface receives all packets otherwise they will get see packets addressed only to them. Your current setup might describe a configuration for a router though but not for a bridge.

eth0 and wlan0 should have no ip addresses (meaning and if desired, you could always use an IP address for br0 though.

Here's some official documentation also: http://wiki.debian.org/BridgeNetworkConnections

  • 2
    I know this is an old post but since I found it while searching for something else, I thought I'd mention that it doesn't matter if a bridge interface does / does not have an IP address as far as bridging is concerned. On Linux, a bridged interface will also relay ARP packets (OSI layer 2). Any switch will map multiple devices connected to the other side of the bridge as being accepted on that switch port. My reference is experience deploying Linux servers as routers, bridges, firewalls, etc for high availability deployments in top tier data centers including one primary USA NAP for S. America
    – jetole
    Apr 13, 2016 at 4:45

configure wlan0

vi /etc/network/interface

iface eth0 inet static

vi /etc/sysctl.conf


vi /etc/rc.local

iptables -t nat -A POSTROUTING -s -o wlan0 -j MASQUERADE
  • this has nothing to do with bridging. you are doing nat.
    – Binar Web
    Dec 1, 2020 at 8:05
  • @BinarWeb what is the difference between nat and bridge?
    – netawater
    Dec 3, 2020 at 7:34
  • First, the OP asked for a wireless bridge. And second, you should read about it if you don't know.
    – Binar Web
    Dec 3, 2020 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.