bridge: add root port blocking