Skip to main content

Hetzner Bridge Network Configuration

Setting up Bridge​

When you order a server from hetzner ( Auction / Normal ) the following would be the state assuming you have only purchased an additional IP and not a subnet

Hetzner Server

Hetzner-specific facts​

These apply to every example below. The values come from Hetzner's official network docs:

  • Bridge name: br0. Do not name your bridge virbr0; that name is reserved by libvirt for its default NAT network and the two will collide.
  • Bridge MAC must match the physical NIC's MAC. Hetzner's switch ports have strict IP/MAC binding. A bridge with a random MAC is silently filtered out by the upstream switch.
  • IPv4: the additional IP / main IP is configured with a /32 netmask plus an on-link route to the gateway. Hetzner's gateway sits outside your /32, so the on-link flag is what tells Linux it is still directly reachable.
  • IPv6 gateway: fe80::1 (link-local). Routes use on-link: true for the same reason.
  • Hetzner DNS: 185.12.64.1, 185.12.64.2 (IPv4) and 2a01:4ff:ff00::add:1, 2a01:4ff:ff00::add:2 (IPv6). Replace stray 8.8.8.8 references in older configs.
  • Interface name in the examples (enp0s31f6) is just an example. Find your real one with ip route | grep default; substitute that name everywhere.
  • Virtual MACs. When you assign an additional single IP to a guest VM, generate a Virtual MAC from Robot for that IP and assign it to the guest's NIC. Without it Hetzner filters guest traffic.

Bridge Mode​

The following file contains the default network configuration on a default installation of Debian on Hetzner.

nano /etc/network/interfaces
### Hetzner Online GmbH installimage
source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback
iface lo inet6 loopback

auto enp0s31f6
iface enp0s31f6 inet static
address 159.69.69.236
netmask 255.255.255.192
gateway 159.69.69.193
# route 159.69.69.192/26 via 159.69.69.193
up route add -net 159.69.69.192 netmask 255.255.255.192 gw 159.69.69.193 dev enp0s31f6

iface enp0s31f6 inet6 static
address 2a01:4f8:231:1526::2
netmask 64
gateway fe80::1

With the above as the starting point, replace it with the bridge configuration below.

### Hetzner Online GmbH installimage
source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback
iface lo inet6 loopback

# Physical interface - no IP, no auto-bring-up of its own
auto enp0s31f6
iface enp0s31f6 inet manual

# Bridge - same MAC as the physical NIC
auto br0
iface br0 inet static
address 159.69.69.236
netmask 255.255.255.255
gateway 159.69.69.193
pointopoint 159.69.69.193
hwaddress ether 90:1b:0e:f1:70:66
dns-nameservers 185.12.64.1 185.12.64.2
bridge_ports enp0s31f6
bridge_stp off
bridge_fd 0
bridge_maxwait 0

iface br0 inet6 static
address 2a01:4f8:231:1526::2
netmask 64
gateway fe80::1
bridge_ports enp0s31f6
bridge_stp off
bridge_fd 0
bridge_maxwait 1

The pointopoint directive on Debian's ifupdown is what implements the same trick as netplan's on-link: true: it tells Debian the gateway is directly reachable even though it is outside the /32.

info

Please perform a reboot to confirm if everything works as expected, incase of any difficulties please reach out to our support.