При поднятии туннеля (--up=script.sh), загоняю интерфейс tap в существующий мост br0 скриптом:
#!/bin/sh
ifconfig $dev up
ip link set up dev $dev
brctl addif br0 $dev
ip link set up dev br0
May 28 16:56:05 pbx kernel: [537315.276478] device tap0 entered promiscuous mode
May 28 16:56:05 pbx kernel: [537315.276786] br0: port 1(tap0) entered forwarding state
May 28 16:56:05 pbx kernel: [537315.276836] br0: port 1(tap0) entered forwarding state
May 28 16:56:06 pbx kernel: [537316.274317] br0: port 1(tap0) entered forwarding state
May 28 16:56:09 pbx ntpd[10881]: Listen normally on 36 tap0 fe80::443e:3bff:fe23:4bd8 UDP 123
May 28 16:56:09 pbx ntpd[10881]: peers refreshed
May 28 16:58:05 pbx kernel: [537434.766200] br0: port 1(tap0) entered disabled state
May 28 16:58:05 pbx kernel: [537434.766457] device tap0 left promiscuous mode
May 28 16:58:05 pbx kernel: [537434.766508] br0: port 1(tap0) entered disabled state
May 28 16:58:07 pbx ntpd[10881]: Deleting interface #36 tap0, fe80::443e:3bff:fe23:4bd8#123, interface stats: received=0, sent=0, dropped=0, active_time=118 secs
На мосту br0 висит только DHCP. На tap0 пока нет соединений. brctl setfd br0 0 сделано.