I am curious if it is possible for users connected to a VPN to perform ARP spoofing / poisoning attacks against other users on the same subnet of an OpenVPN or Wireguard server. Does OpenVPN & Wireguard provide inbuilt mitigation's against ARP attacks by default & if so can this protection be disabled by malicious or compromised servers?
ARP is a link layer 2 ethernet protocol, it does not exist at IP layer 3.
Normally VPNs use TUN, which is layer 3. There is a TAP layer 2 which will carry ARP, but outside of businesses BRIDGING two remote networks together this is seldom used. In a TAP bridge, you probably could ARP spoof.