ansible-roles/vpn/bridge/templates/br0

auto br0
iface br0 inet static
    pre-up /usr/local/sbin/ip-link-add.sh $IFACE type bridge

    post-up /usr/local/sbin/post-up-$IFACE-inet.nft
    post-up /usr/local/sbin/post-up-$IFACE-ipv4.nft
    post-up /usr/local/sbin/post-up-$IFACE-ipv6.nft
{% if vpn_bridge_routing_table is defined %}
    post-up ip rule add dev $IFACE table {{ vpn_bridge_routing_table }}
    post-up ip rule add dev $IFACE to {{ local_inet_network }} table main priority 1
    post-up ip -6 rule add dev $IFACE table {{ vpn_bridge_routing_table }}
    post-up ip -6 rule add dev $IFACE to {{ local_inet6_network }} table main priority 1
{% endif %}

{% if vpn_bridge_routing_table is defined %}
    pre-down ip -6 rule del dev $IFACE to {{ local_inet6_network }} table main priority 1
    pre-down ip -6 rule del dev $IFACE table {{ vpn_bridge_routing_table }}
    pre-down ip rule del dev $IFACE to {{ local_inet_network }} table main priority 1
    pre-down ip rule del dev $IFACE table {{ vpn_bridge_routing_table }}
{% endif %}
    pre-down /usr/local/sbin/pre-down-$IFACE-ipv6.nft
    pre-down /usr/local/sbin/pre-down-$IFACE-ipv4.nft
    pre-down /usr/local/sbin/pre-down-$IFACE-inet.nft

    bridge_stp off
    bridge_waitport 0
    bridge_fd 0
    bridge_ports none

    address {{ vpn_bridge_inet_address }}/{{ vpn_bridge_inet_prefixlen }}

iface br0 inet6 static
    address {{ vpn_bridge_inet6_address }}/{{ vpn_bridge_inet6_prefixlen }}
    dad-attempts 0