sysctl -w net.bridge.bridge-nf-call-iptables=1
iptables -t mangle -I PREROUTING -m physdev --physdev-in vpn1
    -p udp --dport 67:68 -j DROP

## dont accept dhcp packets directed to the local machine
ebtables -A INPUT --in-interface vpn1 --protocol ipv4
    --ip-protocol udp --ip-destination-port 67:68 -j DROP

## dont forward dhcp packets coming in from vpn
ebtables -A FORWARD --in-interface vpn1 --protocol ipv4
    --ip-protocol udp --ip-destination-port 67:68 -j DROP

## dont send dhcp requests over vpn
ebtables -A FORWARD --out-interface vpn1 --protocol ipv4
   --ip-protocol udp --ip-destination-port 67:68 -j DROP