What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To bridge an OpenVPN server to your local network, create an operating-system bridge that joins the LAN-facing Ethernet adapter and a TAP interface, move the server’s LAN IP configuration onto that bridge, and run OpenVPN in bridged mode with dev tap and server-bridge. Build and configure the bridge before OpenVPN starts. Bridging works at Layer 2, so remote clients can appear on the same subnet as local machines, receive addresses through the LAN’s addressing scheme when the DHCP path is working, and use broadcast-based discovery that routed VPNs do not carry.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This is different from the more common routed configuration, which uses dev tun and server. Choose a bridge only when same-subnet behavior, broadcast traffic, or Ethernet-compatible non-IP protocols is genuinely required.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What an OpenVPN network bridge actually does
An Ethernet bridge is a virtual interface that forwards frames between member interfaces as though they were ports on a switch. In this design, one member is the private, LAN-facing physical Ethernet NIC and the other is an OpenVPN TAP interface. OpenVPN encrypts frames entering the TAP device; the bridge then places those frames on the local Ethernet segment, and performs the reverse operation for replies.
The bridge is a Layer 2 construct. A bridged client can therefore use the same IP subnet as devices physically attached to the LAN. Broadcasts and many discovery protocols can cross the VPN, which is useful for legacy applications, network browsing, and software that cannot be configured with a separate routed subnet. The same property increases the broadcast and security surface: traffic that would remain inside the LAN is now potentially available to every connected VPN client.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
The physical NIC and TAP member must not retain the LAN address individually. Once an interface is enslaved to the bridge, the bridge interface owns the IP address, netmask, and broadcast settings. OpenVPN’s configuration refers to the TAP component, not to the bridge name.
Bridge mode versus routed mode
Before changing a production VPN, decide whether Layer 2 behavior is necessary. A routed design is normally simpler to operate and easier to restrict with firewall rules. A bridge is justified when the client must behave like a host plugged into the existing Ethernet segment.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Decision axis | Bridge with TAP | Route with TUN |
|---|---|---|
| Network layer | Layer 2 Ethernet frames | Layer 3 IP packets |
| Client addressing | Can use the existing LAN addressing and DHCP path when broadcasts are permitted; OpenVPN can also provide a bridged address pool with server-bridge. |
Uses a separate VPN subnet allocated by the OpenVPN server. |
| Broadcast and discovery | LAN broadcasts and compatible non-IP protocols can cross the tunnel. | Broadcasts generally do not cross; only routed IP traffic is forwarded. |
| Firewall exposure | Broader: every bridged client shares the Ethernet broadcast domain. | Narrower: rules can limit access to selected IP networks and ports. |
| Operational complexity | Requires bridge creation, IP migration, TAP handling, and careful startup ordering. | Usually requires only tunnel addressing, routes, and forwarding rules. |
| Best fit | Applications that require same-subnet presence, broadcast discovery, or legacy Ethernet behavior. | Remote access to selected servers, subnets, or services where Layer 2 is unnecessary. |
If clients only need access to a few internal IP networks, test a routed tun configuration first. It avoids extending the entire LAN broadcast domain and usually gives you a smaller failure and attack surface.
Plan the bridge before touching the server
Choose the correct physical interface
Use the private LAN-facing Ethernet adapter that should carry VPN client traffic. Do not add the interface used for the server’s direct Internet connection. Bridging an Internet-facing NIC can expose the LAN, create an unintended Layer 2 path, or disconnect the host from its upstream network. The LAN interface should be protected by the host firewall and, where possible, a separate security zone.
Reserve addresses and avoid loops
Record the current IP address, netmask, and broadcast value of the LAN adapter. Those values will move to the bridge interface. Keep the local and remote OpenVPN endpoint addresses outside the bridged subnet; placing an endpoint inside the same bridged range can create a routing loop. Confirm that the address range you intend to hand to VPN clients is free and does not overlap another DHCP pool or VPN.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Confirm transport and interface naming
Both sides must agree on the transport protocol, such as UDP or TCP, and on the TAP device naming. Linux commonly exposes a unit such as tap0; Windows may require an explicit adapter name through dev-node. A correct bridge with a mismatched TAP name still fails to carry traffic.
Linux: create and configure the bridge
The exact commands depend on the distribution and whether it is managed by NetworkManager, systemd-networkd, or traditional ifup scripts. The sequence is constant: install bridge support, create the bridge, attach the LAN NIC and a persistent TAP device, remove IP settings from the members, assign the old LAN settings to the bridge, permit the traffic in the firewall, and only then start OpenVPN.
1. Identify the LAN NIC and preserve its settings
Use your distribution’s interface tools to identify the private Ethernet device and record its current address, netmask, gateway, and broadcast setting. Names such as eth1, enp3s0, or ens192 are examples, not universal names. Perform this work from a local console or an out-of-band management path if possible; moving an interface into a bridge can temporarily interrupt your remote session.
2. Install or enable bridge tooling
Legacy OpenVPN examples use the bridge-utils package and the brctl command. Modern distributions may instead use the kernel’s ip/bridge commands or declarative NetworkManager and systemd-networkd profiles. Use the method supported by your distribution, but ensure the resulting bridge is persistent across reboot.
3. Create the bridge and attach its members
Create a bridge named br0 (or another stable name), add the private physical NIC, and add a persistent TAP interface. A representative legacy sequence is:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
brctl addbr br0
brctl addif br0 eth1
brctl addif br0 tap0With modern tools, the equivalent operations are expressed through ip link and bridge commands or through the distribution’s network manager. The important result is that both the physical NIC and TAP device are bridge ports, and both ports are administratively up.
4. Remove IP configuration from the member interfaces
Flush or otherwise remove the address, netmask, and broadcast configuration from the physical NIC and TAP member. They should carry frames only; neither should own the LAN address. If an old DHCP client continues to run on the physical NIC, stop it or move its profile to the bridge, otherwise two interfaces may compete for the same lease.
5. Put the former LAN configuration on br0
Assign the physical NIC’s former IP address, netmask, and broadcast values to br0. Keep the appropriate gateway and DNS settings on the bridge or the host’s primary network configuration, according to your distribution. For the representative OpenVPN example, the bridge address is 192.168.8.4 with netmask 255.255.255.0. Do not copy that address blindly; use the address actually assigned to your LAN.
# Illustrative values only; replace them with your LAN settings
ip addr flush dev eth1
ip addr add 192.168.8.4/24 brd 192.168.8.255 dev br0
ip link set eth1 up
ip link set tap0 up
ip link set br0 upThe command syntax and gateway handling differ by distribution. Verify with your normal interface-status command that br0 owns the address and that neither member does.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Permit bridge and TAP traffic in the firewall
The host firewall must allow traffic arriving on the TAP and bridge interfaces and forwarding from the bridge. The official example includes these rules:
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPTThese broad examples are a starting point, not a complete security policy. Apply equivalent rules in your firewall framework, restrict source networks and ports where practical, and add return-direction rules according to the stateful firewall in use. Confirm that bridge netfilter settings do not silently drop the frames you intend to pass.
7. Configure OpenVPN for bridged mode
Replace routed-mode directives with a TAP device and a matching server-bridge declaration. A representative server configuration is:
dev tap0
server-bridge 192.168.8.4 255.255.255.0 192.168.8.128 192.168.8.254Here, 192.168.8.4 is the bridge’s LAN address, 255.255.255.0 is its netmask, and 192.168.8.128 through 192.168.8.254 is the example client pool. Replace every value with addresses appropriate to your network. Do not leave a conflicting server directive in the same profile. The OpenVPN dev directive names the TAP component, not br0.
8. Start and stop in the right order
Bring up the bridge and confirm its address before starting OpenVPN. During shutdown, stop OpenVPN first and tear down the bridge afterward. If your service manager starts OpenVPN before the network profile has completed, add an explicit dependency or delay so the TAP member and bridge are ready first.
- Activate the persistent bridge profile.
- Verify that
br0is up, owns the LAN address, and contains the intended NIC and TAP ports. - Start the OpenVPN server.
- Connect one test client and inspect its address, routes, and ability to reach a local LAN host.
- During maintenance, stop OpenVPN before removing the TAP device or bridge.
Windows: create the bridge through Network Connections
On Windows, the documented approach uses the Network Connections interface. The exact labels and driver behavior vary by Windows release and installed OpenVPN/TAP driver, so verify the driver’s documentation for the target version.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
- Install and verify the OpenVPN TAP adapter. Confirm its name in Network Connections and note the physical Ethernet adapter that connects to the private LAN.
- Open the Windows network-adapter list, select the physical Ethernet adapter and the TAP adapter, then use the command to create a network bridge.
- Wait for the bridge object to appear. The two selected adapters become members; do not assign the LAN address separately to either member.
- Open the TCP/IP properties of the bridge object and enter the former LAN IP address, subnet mask, gateway, and DNS settings there. Windows requires these settings on the bridge, not on the individual adapters.
- Configure OpenVPN with
dev tap. If the installation exposes more than one TAP adapter or the generic name is not resolved, adddev-nodewith the exact TAP adapter name shown by Windows. - Start OpenVPN only after the bridge has an address and reports connected. Test from a single client before enabling broad access.
Do not bridge the adapter used for direct Internet access. If Windows loses connectivity after bridge creation, restore the IP settings on the bridge object and leave the member adapters without individual TCP/IP configuration.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How client addressing and LAN DHCP behave
A common expectation is that a bridged VPN client will automatically receive a lease from the same DHCP server used by wired LAN machines. That can work, but only if the DHCP broadcast can traverse the entire path: the client TAP interface, OpenVPN server TAP device, operating-system bridge, physical LAN, and any switch or firewall policies in between.
When DHCP fails, first verify that the client is truly using TAP and that the server is using server-bridge, not server with dev tun. Then confirm that the TAP device is actually a member of br0, that the bridge is attached to the private LAN NIC, and that firewall rules permit broadcast and DHCP traffic. A bridge that was created after OpenVPN started can leave the daemon attached to the wrong or missing interface.
You can avoid dependence on the LAN DHCP server by using an explicit address pool in server-bridge, as in the representative 192.168.8.128–192.168.8.254 range. That pool still must be on the same bridged subnet and must not overlap addresses handed out elsewhere. If neither DHCP nor the configured pool works, inspect the client log for an address-assignment failure and verify that the client and server use compatible TAP drivers and transport settings.
Troubleshooting by symptom
The host loses network access immediately
- The LAN address is probably still configured on the physical NIC or was never assigned to
br0. - Restore the address, netmask, and broadcast values on the bridge interface; member interfaces should have no individual IP configuration.
- Check the default route and gateway after the move. A bridge migration can interrupt an active SSH or remote-management session, so use local or out-of-band access for recovery.
The VPN connects but clients cannot reach LAN hosts
- Confirm that the server uses
dev tapandserver-bridge, and that the TAP unit named in OpenVPN is the one attached tobr0. - Verify that the physical member is the private LAN NIC, not an Internet-facing interface.
- Check firewall INPUT and FORWARD policy for
tap0andbr0, including return traffic. - Inspect the bridge membership and link state. A down port or a bridge started after OpenVPN can produce a successful tunnel handshake with no LAN data.
Clients receive no address from DHCP
- Check that the client is running a TAP configuration rather than a TUN profile.
- Ensure DHCP broadcasts are not filtered by the host firewall, bridge netfilter, or a managed switch.
- Test the explicit
server-bridgepool if the LAN DHCP path is unreliable, making sure the pool does not overlap another scope. - Review client and server logs for TAP-driver, transport, or device-name mismatches.
Only some discovery protocols work
Bridging carries Ethernet-compatible traffic, but applications can still depend on local firewall profiles, multicast handling, driver support, or protocol-specific restrictions. Test the exact application rather than assuming that a successful IP ping proves every discovery mechanism will work.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The bridge creates intermittent or duplicate connectivity
- Make sure the same LAN address is not configured on both
br0and the physical NIC. - Check for a second DHCP server or overlapping VPN pool.
- Ensure the endpoint addresses remain outside the bridged subnet so traffic cannot loop back through the bridge.
- Confirm that only one network manager owns the interface. Simultaneous legacy scripts and NetworkManager profiles can repeatedly change bridge membership.
Security and operational safeguards
Because a bridge extends the LAN broadcast domain, treat every VPN client as a host on that segment. Use client certificates and access controls appropriate to your OpenVPN deployment, limit who can connect, and apply host and LAN firewall rules that prevent unnecessary lateral access. Permit only the broadcasts and services that the use case requires when your firewall supports that level of filtering.
Keep the bridge on a private, firewall-protected interface. Never use a bridge as a shortcut to place remote clients directly on an untrusted or Internet-facing segment. Monitor address allocation so a bridged client cannot collide with a statically configured host, and document the bridge’s member interfaces, address ownership, startup dependency, and recovery procedure.
Validation checklist
- The physical member is the private LAN-facing NIC.
- The bridge exists before OpenVPN starts.
- The LAN IP address, netmask, and broadcast values belong to the bridge, not its members.
- The TAP device is a bridge port and matches the OpenVPN
devordev-nodesetting. - The server configuration uses
dev tapand a matchingserver-bridgedeclaration. - The client and server agree on UDP or TCP transport and TAP naming.
- Firewall rules permit the intended TAP, bridge, forwarding, DHCP, and return traffic.
- The VPN address pool does not overlap the LAN’s existing allocations.
- Endpoint addresses are outside the bridged subnet.
- A test client can obtain or be assigned an address, reach an approved LAN host, and use the required broadcast-dependent application.
When not to build a bridge
If the requirement is simply “let a remote user reach an internal web server, file share, or a few private subnets,” a routed tun deployment is generally the better design. It avoids carrying broadcasts, reduces the number of devices exposed to VPN clients, and is easier to segment with Layer 3 firewall rules. Build the TAP bridge when the application’s same-subnet or Layer 2 requirement has been verified, not merely because it appears to make addressing familiar.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
