iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
To place OpenVPN clients directly on the same Ethernet subnet as your local network, create an operating-system bridge that joins the LAN-facing Ethernet adapter to a TAP interface, move the server’s LAN IP configuration onto that bridge, and start OpenVPN with dev tap and server-bridge. A routed dev tun configuration is a better choice when clients only need access to selected IP networks.
The order matters: build and configure the bridge first, permit bridge and TAP traffic through the firewall, then start OpenVPN. Bridging provides Layer-2 behavior such as LAN DHCP, broadcasts and some non-IP protocols, but it also exposes more of the LAN and is operationally more complex than routing.
What an OpenVPN network bridge does
An Ethernet bridge is a virtual network interface that combines one or more Ethernet interfaces. In this design, the members are a physical, LAN-facing NIC and an OpenVPN TAP interface. The bridge forwards Ethernet frames between them, so a connected VPN client can behave like another device on the local switch rather than a host behind a routed VPN subnet.
Because the bridge works at Layer 2, clients can participate in the existing LAN subnet. DHCP broadcasts can cross the TAP connection, devices can use broadcast-based discovery, and Ethernet-compatible non-IP traffic can be carried when the protocol and client operating system support it. The server’s former Ethernet address, netmask and broadcast settings belong on the bridge object; the member interfaces must not retain separate LAN IP configurations.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
OpenVPN must be told to use the TAP component of the bridge, not the bridge name itself. A bridged server therefore uses dev tap (or a specific unit such as dev tap0) and a matching server-bridge declaration. A normal routed server uses dev tun and server, which is a different architecture.
Bridge or routed VPN: choose before changing the host
Bridging is justified when the requirement is genuinely Layer 2. If users only need to reach a few internal IP subnets, routing is usually simpler, easier to firewall and easier to troubleshoot. Compare the designs against the actual requirement rather than assuming that a bridge is inherently more capable.
| Decision point | Bridged TAP design | Routed TUN design |
|---|---|---|
| Network layer | Layer 2 Ethernet frames are joined to the LAN. | Layer 3 IP packets are routed between VPN and internal networks. |
| Client addressing | Clients can appear in the existing LAN subnet and can use a bridged DHCP path or the address pool in server-bridge. |
Clients receive addresses from a separate VPN network defined by server. |
| Broadcasts and discovery | Broadcast traffic and supported Ethernet-compatible protocols can cross the VPN. | Broadcasts normally do not cross; access must be provided with routes and, where needed, protocol-specific relays. |
| Exposure | The LAN broadcast and security domain is extended to remote clients. | Firewall rules can limit access to selected routed subnets and ports. |
| Operations | Requires bridge creation, member-interface IP changes, TAP naming and careful startup ordering. | Usually requires fewer interface changes and is the simpler default. |
| Best fit | Legacy discovery, same-subnet behavior, DHCP-dependent applications or non-IP Ethernet traffic. | Remote access to defined IP networks without extending the entire broadcast domain. |
Prerequisites and safety checks
- Administrative access to the OpenVPN server and permission to change its network configuration.
- A private, LAN-facing Ethernet interface that can be safely attached to a bridge. Do not select the interface used for the server’s direct Internet connection.
- A TAP driver and a TAP device supported by the installed OpenVPN version. The server and clients must agree on TAP mode, transport and device naming.
- A maintenance window or console access. Moving an IP address from a physical NIC to a bridge can temporarily disconnect the host, including your remote management session.
- A plan for addresses. Preserve the server’s existing LAN IP, netmask and broadcast values on the bridge, and reserve a non-conflicting client range if you specify one in
server-bridge. - Firewall rules that allow the bridge and TAP traffic required by your policy. Bridging increases the broadcast and security surface, so do not treat it as an unrestricted shortcut.
Keep the OpenVPN local and remote endpoint addresses outside the bridged subnet. If an endpoint is placed inside the network being bridged, traffic can be sent back through the tunnel and create a routing loop.
Linux: create and configure the bridge
The following is a representative Linux procedure. Distribution networking stacks differ: older examples use bridge-utils and brctl, while current systems may use NetworkManager, systemd-networkd, or the ip and bridge commands. The OpenVPN requirement is the same in every case: the bridge must exist, contain the LAN NIC and TAP device, and own the IP configuration before OpenVPN starts.
1. Identify the correct interfaces
List interfaces with your distribution’s network tools and identify the private Ethernet adapter, for example eth1 or a predictable modern name such as enp3s0. Confirm that it carries the LAN address and default LAN route. Do not infer that the first interface listed is safe: many servers use one NIC for Internet access and another for the private network.
Also decide the bridge and TAP names. The examples below use br0 for the bridge and tap0 for the persistent TAP device. Substitute the names actually created on your host and use the same TAP name in OpenVPN’s dev directive.
Recommended Free Tools
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
2. Install or enable bridge support
Install the bridge tooling supplied by your distribution if it is not already present. The official examples use the bridge-utils package and brctl. A modern distribution may instead manage the bridge declaratively through NetworkManager or systemd-networkd; in that case create a persistent bridge profile and attach the two member interfaces through that manager rather than mixing competing configuration systems.
3. Stop OpenVPN before changing interfaces
Stop the OpenVPN server instance with the service manager used by the distribution. Do not let OpenVPN recreate or claim the TAP device while you are attaching it to the bridge. Record the current Ethernet IP address, netmask, broadcast address, gateway and DNS settings before removing them from the physical NIC.
4. Create the bridge and attach both members
Create br0, create or enable a persistent tap0, and add the LAN NIC and TAP device as bridge members. With legacy bridge tooling, the operations are conceptually equivalent to:
sudo brctl addbr br0
sudo brctl addif br0 eth1
sudo brctl addif br0 tap0Bring the bridge and its members up with your distribution’s network manager or low-level link commands. The physical NIC and TAP member should carry frames only; they should not keep independent IP addresses. If your manager creates the TAP device automatically when OpenVPN starts, use a pre-start bridge hook or another persistent mechanism so that the TAP is attached before the daemon begins.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →5. Move the LAN IP configuration to br0
Flush the old address from the physical NIC, then assign those same values to br0. A representative address operation is:
sudo ip addr flush dev eth1
sudo ip addr add 192.168.8.4/24 broadcast 192.168.8.255 dev br0
sudo ip link set br0 upThe address in this example is illustrative; use the server’s real LAN address, netmask and broadcast values. Restore the appropriate default route and resolver settings through the same network manager that owns the host. Never leave the former Ethernet address on both eth1 and br0, because duplicate addresses cause ARP instability and intermittent connectivity.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
At this point, test the server from a local console if possible. A brief outage while the address moves is expected, but the host should recover on the bridge address before you proceed. If it does not, undo the bridge change from the console rather than repeatedly reconnecting over the network.
6. Permit bridge and TAP traffic in the firewall
The OpenVPN guide’s representative rules allow input on the TAP and bridge interfaces and forwarding from the bridge:
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPTApply equivalent rules in the firewall framework used by your distribution, and add only the return-path and management rules your policy requires. These examples are intentionally broad; production systems should restrict source networks, services and administrative access where practical. Make the rules persistent so a reboot does not silently leave the bridge unusable or overly exposed.
7. Configure OpenVPN for bridged mode
Replace the routed directives with a TAP device and a matching bridge declaration. The representative configuration is:
dev tap0
server-bridge 192.168.8.4 255.255.255.0 192.168.8.128 192.168.8.254Here, 192.168.8.4 is the server’s bridge address, 255.255.255.0 is the LAN netmask, and 192.168.8.128 through 192.168.8.254 is the client range supplied by the OpenVPN bridge configuration. Choose values that belong to the LAN subnet but are excluded from ordinary DHCP leases and static assignments. Do not reuse the illustrative numbers unless they match your network.
Remove or comment out the old dev tun and server directives; leaving both modes in one server profile creates a conflicting design. Ensure the client profiles also request TAP mode and use the same UDP or TCP transport selected by the server. If the host has several TAP adapters, set the device explicitly and verify that the named adapter is the one attached to br0.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
8. Start and stop in the correct order
Start the bridge first, confirm that br0 is up and owns the LAN address, verify that the TAP device is attached, and only then start OpenVPN. During shutdown, stop OpenVPN before dismantling the bridge. Reversing the order can leave OpenVPN without its device or can strand the server’s IP configuration on a member that is no longer carrying traffic.
9. Make the design persistent
A bridge created manually at a shell prompt disappears or loses members after a reboot unless the distribution’s network configuration recreates it. Store the bridge, member, address, route and firewall definitions in one supported configuration system. Test a reboot from console access, then confirm that br0 is configured before the OpenVPN service starts. If the service manager has dependencies, express the bridge as a prerequisite rather than relying on timing delays.
Windows: create the bridge
Windows uses the Network Connections interface to combine a physical adapter and the installed OpenVPN TAP adapter.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Open Network Connections, for example with
ncpa.cpl, and identify the private Ethernet adapter and the TAP adapter used by OpenVPN. - Select both adapters, right-click the selection, and choose the command that creates a network bridge. Windows creates a new Network Bridge object and treats the selected adapters as members.
- Open the TCP/IP properties for the Network Bridge object and apply the server’s LAN address, netmask, gateway and DNS settings there. Remove those settings from the individual member adapters; the bridge, not either member, owns the LAN configuration.
- Confirm that the bridge reaches the private LAN before starting OpenVPN. If the host becomes unreachable, use local console access and restore the address to the bridge object.
- Set the OpenVPN profile to
dev tap. When more than one TAP adapter exists or automatic selection fails, usedev-nodewith the installed adapter’s exact name. - Start OpenVPN only after Windows reports the bridge as connected, then test a client on the LAN subnet.
Exact labels and driver behavior vary by Windows release and TAP driver version. If a menu item or adapter name differs, use the documentation for the installed OpenVPN/TAP package rather than assuming that a similarly named virtual adapter is interchangeable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How clients receive addresses and reach the LAN
A bridged client sends Ethernet frames through the TAP interface and into the LAN bridge. That is why DHCP discovery and other broadcasts can reach the local network, provided the LAN DHCP service is designed to answer them and the firewall permits the traffic. Alternatively, the server-bridge declaration can provide a defined address range, as in the representative configuration above.
Do not place the bridge client range over active DHCP leases, statically assigned devices or the server’s own address. Address conflicts can look like a VPN authentication problem even though the tunnel is established. Check the LAN DHCP scope, reservations and exclusions before selecting the pool.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Bridging does not guarantee that every discovery protocol will work through every operating system or client firewall. The protocol must be Ethernet-compatible, and the endpoint must allow it. A routed design may still be preferable if the application can use known IP addresses instead of broadcasts.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTroubleshooting by symptom
The server loses connectivity after the NIC is bridged
The usual cause is that the old IP configuration remains on the physical NIC or was never assigned to the bridge. From a local console, remove the address from the member, place the former IP, netmask and broadcast values on br0, and restore the gateway and routes. Check that the physical NIC is actually a member of the intended bridge and that the bridge link is up. Do not continue testing over a remote session until the host is reachable on the bridge address.
OpenVPN starts but clients receive no LAN address
Verify that the server profile uses dev tap and server-bridge, not the routed dev tun and server directives. Confirm that the TAP device named in the profile is the one attached to br0. Then check the firewall on the bridge, TAP and forwarding paths. If you expect an existing DHCP service to answer, make sure the DHCP broadcast can traverse the bridge and that the selected client addresses do not overlap another scope. If you use a server-bridge pool, verify that every address is on the LAN subnet and unused.
The daemon reports that the device is missing
OpenVPN may be starting before the bridge or TAP device exists, or the profile may name tap0 while the operating system created another unit. Create the bridge and persistent TAP first, correct the dev or dev-node value, and establish a service dependency so the network is ready before OpenVPN starts.
The tunnel connects, but LAN hosts do not respond
Check that the LAN-facing interface, rather than the Internet-facing interface, is in the bridge. Confirm that the bridge owns the server address, that host and client firewalls allow the traffic, and that the client is not using an address already assigned elsewhere. Also verify that server and client agree on UDP or TCP transport and on TAP mode. A successful TLS connection alone does not prove that Layer-2 forwarding is working.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBroadcast traffic creates unwanted exposure
That behavior is inherent to extending a broadcast domain. Restrict who can connect, limit firewall rules to the required services, and avoid bridging when routed access satisfies the application. Remote clients should be treated as members of the LAN security boundary, not as isolated routed peers.
A loop or unstable routing appears
Inspect the endpoint addresses and routes. The OpenVPN local and remote endpoints must remain outside the subnet being bridged. An endpoint inside that subnet can cause traffic to be sent back through the VPN, creating a loop or making the server intermittently unreachable.
Operational checklist
- Confirm the chosen NIC is private and LAN-facing.
- Create
br0and attach the intended physical NIC and TAP device. - Remove IP settings from both members.
- Assign the former LAN IP, netmask and broadcast values to
br0. - Keep endpoints outside the bridged subnet.
- Use
dev tapplus a matchingserver-bridgedeclaration. - Reserve a non-conflicting client range if the bridge configuration supplies addresses.
- Permit required TAP, bridge and forwarding traffic in the host firewall.
- Start the bridge before OpenVPN and stop OpenVPN before dismantling it.
- Test DHCP, direct LAN access and any required broadcast-based application from a VPN client.
- Document the persistent network-manager or Windows configuration so a reboot reproduces the same topology.
When to remove the bridge
Reconsider the design if clients do not need same-subnet addresses, LAN broadcasts or non-IP Ethernet protocols. Replacing the bridge with a routed tun configuration can reduce broadcast traffic, narrow the firewall exposure and simplify startup. Make that change as a planned migration: clients need new VPN settings and routes, and applications that depended on Layer-2 discovery must be tested using their routed alternatives.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
