The default block all incoming and allow all outgoing works fine for me. ARP and such won't traverse the router and the VPN should be a full tunnel, so no device info except the travel router itself should leak.
OpenWrt Travelmate is great for this purpose.
Gotcha. I'm using a ATX 1800 with full tunnel. I figured there would be a default deny all (haven't touched anything in the way of the firewall on that device yet), but wasn't sure if ARP would be able to get past it from the public AP side. I guess I can always do a few experiments at home in the lab too. Thanks again!
They run NAT/Firewall by default (or at least mine does), but I also have the VPN tunnel to home because it's convenient for accessing stuff and hides traffic.