To understand, your need to logically imagine the difference between tun/tap: in tap mode, you need a br0 bridge, working --for addresses of bare iron, and with tun it is on the contrary, it is traffic from VPN server 'Work VPN', as you can see here in the picture:
And in order to have a tun, you need to create it first, you can use
VPN over SSH (Wikipedia):
tun will create a routed IP tunnel,
tap will create an ethernet tunnel.
tap0 if you are ethernet bridging and have precreated a tap0 virtual interface and bridged it with your ethernet interface.
If you want to control access policies over the VPN, you must create firewall rules for the the tun/tap interface.
On non-Windows systems, you can give an explicit unit number, such as tun0. On most systems, the VPN will not function unless you partially or fully disable the firewall for the tun/tap interface.