Every time the VPN is started the TAP interface is created. This is why it gets removed from the bridge and you have to add it again.

A L2 VPN using OpenVPN usually has a start.sh where you create a separate bridge and then bridge the tap and the physical interface.

I have something along the lines:

remote X.X.X.X
dev somename
dev-type tap
float


port 12345
persist-tun
persist-local-ip
persist-remote-ip
comp-lzo
ping 15
secret somekey
user openvpn
group openvpn
cipher somechipher
mssfix 0
fragment 0


log somewhere.log
log-append  somewhere.log

verb 3

up /etc/openvpn/somename/somenameup.sh
down /etc/openvpn/somename/somenamedown.sh

VPN start bridge script somenameup.sh

#!/bin/sh

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="VlanXXX"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="somename"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"

/usr/sbin/brctl addbr $br
/usr/sbin/brctl addif $br $eth

for t in $tap; do
    /usr/sbin/brctl addif $br $t
done

for t in $tap; do
    /sbin/ifconfig $t 0.0.0.0 promisc up
done

/sbin/ifconfig $eth 0.0.0.0 promisc up

VPN stop bridge kill script

#!/bin/sh

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="VlanXXX"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="somename"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"

brctl delbr $br