diff --git a/pkg/hostman/hostinfo/hostbridge/hostbridge.go b/pkg/hostman/hostinfo/hostbridge/hostbridge.go
index 8f1f22342a..0f21651064 100644
--- a/pkg/hostman/hostinfo/hostbridge/hostbridge.go
+++ b/pkg/hostman/hostinfo/hostbridge/hostbridge.go
@@ -27,6 +27,7 @@ import (
 
 	"yunion.io/x/onecloud/pkg/hostman/options"
 	"yunion.io/x/onecloud/pkg/util/fileutils2"
+	"yunion.io/x/onecloud/pkg/util/iproute2"
 	"yunion.io/x/onecloud/pkg/util/netutils2"
 	"yunion.io/x/onecloud/pkg/util/procutils"
 )
@@ -103,11 +104,13 @@ func (d *SBaseBridgeDriver) BringupInterface() error {
 		infs = append(infs, d.inter)
 	}
 	for _, inf := range infs {
-		cmd := []string{"ifconfig", inf.String(), "up"}
+		l := iproute2.NewLink(inf.String())
+		l.Up()
 		if options.HostOptions.TunnelPaddingBytes > 0 {
-			cmd = append(cmd, "mtu", fmt.Sprintf("%d", 1500+options.HostOptions.TunnelPaddingBytes))
+			mtu := int(1500 + options.HostOptions.TunnelPaddingBytes)
+			l.MTU(mtu)
 		}
-		if _, err := procutils.NewCommand(cmd[0], cmd[1:]...).Output(); err != nil {
+		if err := l.Err(); err != nil {
 			return err
 		}
 	}
@@ -115,12 +118,6 @@ func (d *SBaseBridgeDriver) BringupInterface() error {
 }
 
 func (d *SBaseBridgeDriver) ConfirmToConfig() (bool, error) {
-	// This serve as a preflight check for existence of ifconfig command
-	output, err := procutils.NewCommand("ifconfig").Output()
-	if err != nil {
-		return false, errors.Wrapf(err, "exec ifconfig %s", output)
-	}
-
 	exist, err := d.drv.Exists()
 	if err != nil {
 		return false, err
@@ -179,24 +176,32 @@ func (d *SBaseBridgeDriver) ConfirmToConfig() (bool, error) {
 }
 
 func (d *SBaseBridgeDriver) SetupAddresses(mask net.IPMask) error {
-	var addr string
-	if len(d.ip) == 0 {
-		addr, mask = netutils2.GetSecretInterfaceAddress()
-	} else {
-		addr = d.ip
+	br := d.bridge.String()
+	{
+		var (
+			addr    string
+			masklen int
+		)
+		if len(d.ip) == 0 {
+			addr, masklen = netutils2.GetSecretInterfaceAddress()
+		} else {
+			masklen, _ = mask.Size()
+		}
+		addrStr := fmt.Sprintf("%s/%d", addr, masklen)
+		if err := iproute2.NewAddress(br, addrStr).Exact().Err(); err != nil {
+			return errors.Wrapf(err, "set bridge %s address", br)
+		}
 	}
-	cmd := []string{"ifconfig", d.bridge.String(), addr, "netmask", netutils2.NetBytes2Mask(mask)}
 	if options.HostOptions.TunnelPaddingBytes > 0 {
-		cmd = append(cmd, "mtu", fmt.Sprintf("%d", options.HostOptions.TunnelPaddingBytes+1500))
-	}
-	if _, err := procutils.NewCommand(cmd[0], cmd[1:]...).Output(); err != nil {
-		log.Errorln(err)
-		return fmt.Errorf("Failed to bring up bridge %s", d.bridge)
+		mtu := 1500 + int(options.HostOptions.TunnelPaddingBytes)
+		if err := iproute2.NewLink(br).MTU(mtu).Err(); err != nil {
+			return errors.Wrapf(err, "setting bridge %s mtu %d", br, mtu)
+		}
 	}
 	if d.inter != nil {
-		if _, err := procutils.NewCommand("ifconfig", d.inter.String(), "0", "up").Output(); err != nil {
-			log.Errorln(err)
-			return fmt.Errorf("Failed to bring up interface %s", d.inter)
+		ifname := d.inter.String()
+		if err := iproute2.NewLink(ifname).Up().Err(); err != nil {
+			return errors.Wrapf(err, "setting bridge %s ifname %s up", br, ifname)
 		}
 	}
 	return nil
@@ -204,16 +209,12 @@ func (d *SBaseBridgeDriver) SetupAddresses(mask net.IPMask) error {
 
 func (d *SBaseBridgeDriver) SetupSlaveAddresses(slaveAddrs [][]string) error {
 	for _, slaveAddr := range slaveAddrs {
-		cmd := []string{"ip", "address", "del",
-			fmt.Sprintf("%s/%s", slaveAddr[0], slaveAddr[1]), "dev", d.inter.String()}
-		if _, err := procutils.NewCommand(cmd[0], cmd[1:]...).Output(); err != nil {
-			log.Errorf("Failed to remove slave address from interface %s: %s", d.inter, err)
+		if err := iproute2.NewAddress(d.inter.String()).Exact().Err(); err != nil {
+			return errors.Wrap(err, "remove address on slave interface")
 		}
-
-		cmd = []string{"ip", "address", "add",
-			fmt.Sprintf("%s/%s", slaveAddr[0], slaveAddr[1]), "dev", d.bridge.String()}
-		if _, err := procutils.NewCommand(cmd[0], cmd[1:]...).Output(); err != nil {
-			return fmt.Errorf("Failed to remove slave address from interface %s: %s", d.bridge, err)
+		addr := fmt.Sprintf("%s/%s", slaveAddr[0], slaveAddr[1])
+		if err := iproute2.NewAddress(d.bridge.String(), addr).Add().Err(); err != nil {
+			return errors.Wrap(err, "move address to bridge interface")
 		}
 	}
 	return nil
diff --git a/pkg/hostman/hostinfo/hostbridge/linux_bridge.go b/pkg/hostman/hostinfo/hostbridge/linux_bridge.go
index 75d8a5e7cf..7f83be3e58 100644
--- a/pkg/hostman/hostinfo/hostbridge/linux_bridge.go
+++ b/pkg/hostman/hostinfo/hostbridge/linux_bridge.go
@@ -25,6 +25,7 @@ import (
 	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/hostman/options"
+	"yunion.io/x/onecloud/pkg/util/iproute2"
 	"yunion.io/x/onecloud/pkg/util/procutils"
 )
 
@@ -93,9 +94,10 @@ func (l *SLinuxBridgeDriver) getUpScripts(nic jsonutils.JSONObject) (string, err
 	s := "#!/bin/bash\n\n"
 	s += fmt.Sprintf("switch='%s'\n", l.bridge)
 	if options.HostOptions.TunnelPaddingBytes > 0 {
-		s += fmt.Sprintf("/sbin/ifconfig $1 mtu %d\n", 1500+options.HostOptions.TunnelPaddingBytes)
+		s += fmt.Sprintf("ip link set dev $1 mtu %d\n", 1500+options.HostOptions.TunnelPaddingBytes)
 	}
-	s += "/sbin/ifconfig $1 0.0.0.0 up\n"
+	s += "ip address flush dev $1\n"
+	s += "ip link set dev $1 up\n"
 	s += "brctl addif ${switch} $1\n"
 	return s, nil
 }
@@ -107,7 +109,7 @@ func (l *SLinuxBridgeDriver) getDownScripts(nic jsonutils.JSONObject) (string, e
 	s += "if [ $? -ne '0' ]; then\n"
 	s += "    exit 0\n"
 	s += "fi\n"
-	s += "/sbin/ifconfig $1 0.0.0.0 down\n"
+	s += "ip link set dev $1 down\n"
 	s += "brctl delif ${switch} $1\n"
 	return s, nil
 }
@@ -127,9 +129,9 @@ func (l *SLinuxBridgeDriver) SetupBridgeDev() error {
 }
 
 func (d *SLinuxBridgeDriver) PersistentMac() error {
-	output, err := procutils.NewCommand("ifconfig", d.bridge.String(), "hw", "ether", d.inter.Mac).Output()
-	if err != nil {
-		return fmt.Errorf("Linux bridge set mac address failed %s %s", output, err)
+	l := iproute2.NewLink(d.bridge.String()).Address(d.inter.Mac)
+	if err := l.Err(); err != nil {
+		return fmt.Errorf("Linux bridge set mac address failed: %v", err)
 	}
 	return nil
 }
diff --git a/pkg/hostman/hostinfo/hostbridge/ovs.go b/pkg/hostman/hostinfo/hostbridge/ovs.go
index 53537de582..c5958e9841 100644
--- a/pkg/hostman/hostinfo/hostbridge/ovs.go
+++ b/pkg/hostman/hostinfo/hostbridge/ovs.go
@@ -142,10 +142,11 @@ func (o *SOVSBridgeDriver) getUpScripts(nic jsonutils.JSONObject) (string, error
 	}
 	s += fmt.Sprintf("LIMIT_DOWNLOAD='%dmbit'\n", bwDownload)
 	if options.HostOptions.TunnelPaddingBytes > 0 {
-		s += fmt.Sprintf("/sbin/ifconfig $IF mtu %d\n",
+		s += fmt.Sprintf("ip link set dev $IF mtu %d\n",
 			1500+options.HostOptions.TunnelPaddingBytes)
 	}
-	s += "/sbin/ifconfig $IF 0.0.0.0 up\n"
+	s += "ip address flush dev $IF\n"
+	s += "ip link set dev $IF up\n"
 	s += "ovs-vsctl list-ifaces $SWITCH | grep -w $IF > /dev/null 2>&1\n"
 	s += "if [ $? -eq '0' ]; then\n"
 	s += "    ovs-vsctl del-port $SWITCH $IF\n"
@@ -201,7 +202,7 @@ func (o *SOVSBridgeDriver) getDownScripts(nic jsonutils.JSONObject) (string, err
 		s += "    " + o.DelFlow(r.cond)
 	}
 	s += "fi\n"
-	s += "/sbin/ifconfig $IF 0.0.0.0 down\n"
+	s += "ip link set dev $IF down\n"
 	s += "ovs-vsctl -- --if-exists del-port $SWITCH $IF\n"
 	return s, nil
 }
diff --git a/pkg/util/netutils2/netutils.go b/pkg/util/netutils2/netutils.go
index 0db12c373b..080ddbabc2 100644
--- a/pkg/util/netutils2/netutils.go
+++ b/pkg/util/netutils2/netutils.go
@@ -303,9 +303,12 @@ type SNetInterface struct {
 	Mtu int
 }
 
-var SECRET_PREFIX = "169.254"
-var SECRET_MASK = []byte{255, 255, 255, 255}
-var secretInterfaceIndex = 254
+var (
+	SECRET_PREFIX        = "169.254"
+	SECRET_MASK          = []byte{255, 255, 255, 255}
+	SECRET_MASK_LEN      = 32
+	secretInterfaceIndex = 254
+)
 
 func NewNetInterface(name string) *SNetInterface {
 	n := new(SNetInterface)
@@ -396,10 +399,10 @@ func (n *SNetInterface) IsSecretAddress(addr string, mask []byte) bool {
 	}
 }
 
-func GetSecretInterfaceAddress() (string, []byte) {
+func GetSecretInterfaceAddress() (string, int) {
 	addr := fmt.Sprintf("%s.%d.1", SECRET_PREFIX, secretInterfaceIndex)
 	secretInterfaceIndex -= 1
-	return addr, SECRET_MASK
+	return addr, SECRET_MASK_LEN
 }
 
 func (n *SNetInterface) GetRoutes(gwOnly bool) [][]string {