We're using bridged ethernet to accomplish network bridging, so each node has a
bridge device consisting of the node's ethernet connection and both VPN TAP
devices on that node.
All hosts are on the class-A 10.*.*.* subnet, with IP conflicts resolved by
allocating a class-B address space (10.x.*.*) to each network. DHCP queries
have naturally been blocked over the VPN by using ebtables.
In order to avoid loops, etc., we've enabled STP on our VPN nodes.
The upshot of all this is the following: we now have a fully functioning,
pretty rock-solid implementation.
Sadly we have a niggle (there's always one). Because we're using STP, one node
is always elected as the root node. Lets's say node A is elected. Now all
communications from C -> B must go through A. This is slower than the ideal
situation, where comms from C -> B (and back) would go through the C -> B VPN
link.