Can someone confirm this will work?

It would be possible. I have something slightly different - multiple clients can connect via OpenVPN, communicate with one another via the VPN using 10.x.x.x VPN addresses, and also reach the outside world via NAT through the secondary IP. One specific client gets a fixed VPN address, so that I can forward ports to it.

If you were only concerned with one client, you could have OpenVPN always assign the same 10.x.x.x address to it, and then configure static NAT in iptables to send traffic to and from the VPN client.

Well, I'd really rather not resort to assigning a 10.* address to the client, because then it has no knowledge of its real public IP address.

Also, I've seen a few posts saying the TUN/TAP driver is built into the supplied kernels – what about the bridging driver (i.e. the one that creates the "br0" interface in ifconfig?) This is what I'd prefer to use (i.e. bridging mode in OpenVPN, versus routing mode).

> Also, I've seen a few posts saying the TUN/TAP driver is built into the supplied kernels – what about the bridging driver (i.e. the one that creates the "br0" interface in ifconfig?) Ooh, I found an earlier post with all the kernel config options it – looks like it's there, great.