The default block all incoming and allow all outgoing works fine for me. ARP and such won't traverse the router and the VPN should be a full tunnel, so no device info except the travel router itself should leak.
OpenWrt Travelmate is great for this purpose.
Gotcha. I'm using a ATX 1800 with full tunnel. I figured there would be a default deny all (haven't touched anything in the way of the firewall on that device yet), but wasn't sure if ARP would be able to get past it from the public AP side. I guess I can always do a few experiments at home in the lab too. Thanks again!
I use one for travel abroad and wireguard/open vpn connections. I just set up another at home as a server and I'm thinking of setting up tail scale and maybe getting some services running. They're good devices.
They run NAT/Firewall by default (or at least mine does), but I also have the VPN tunnel to home because it's convenient for accessing stuff and hides traffic.