Can't ping 2nd router from VPN subnet

[blitzkrieg]

From my previous issue, I can deduce:
1) PC/client able to ping/access webUI of DLink router, be it connected to Asus or DLink, wired or wireless.
2) Ping from the Asus Ping tool fails. Ping within PuTTY SSH fails. Ping from external through OpenVPN fails too (essentially the server is in the Asus).
3) Ping through another OpenVPN server connected in the LAN works.

So it has nothing to do with OpenVPN not forwarding packets, rather the Asus router not able to find a route to the DLink?? Doesn't make sense as PC/client able to ping each other.
Anybody have any routing suggestion?
Here's the current table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
44.125.x.1      0.0.0.0         255.255.255.255 UH    0      0        0 eth0
192.168.4.0     0.0.0.0         255.255.255.128 U     0      0        0 br0
192.168.4.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun21
44.125.x.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         44.125.x.1      0.0.0.0         UG    0      0        0 eth0

 

[blitzkrieg]

After days of head scratching, I attempted:
1) factory defaults the DLink, and now the Asus Ping tool is able to ping it.
2) Connecting OpenVPN and SSH in terminal allows to ping the DLink too (since its coming from the Asus).
3) HOWever, pinging as an OpenVPN client from a normal terminal(not SSH) fails. Accesing the webUI of DLink thus fails.
4) Attempted factory reset the Asus and deleting all iptables entries and change policy to ACCEPT to isolate, but still unable to ping/access the webUI as an OpenVPN client.

Can I conclude that it's not firewall/iptables that's blocking it? Rather somehow a routing issue, since its a 10.8.0.0 client that's sending out the request and not a 192.168.4.0 client?
What am I missing in this cascading setup?

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
44.125.x.1      0.0.0.0         255.255.255.255 UH    0      0        0 eth0
192.168.4.0     0.0.0.0         255.255.255.128 U     0      0        0 br0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun21
44.125.x.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         44.125.x.1      0.0.0.0         UG    0      0        0 eth0

 

[bbunge]

Something does not seem right with your setup. Why use a 25 CIDR? Just set the AC66U to 192.168.4.1 with a mask of 255.255.255.0, the dlink as an access point and let the Asus assign the network IP addresses.

Sent from my P01M using Tapatalk

 

[blitzkrieg]

Something does not seem right with your setup. Why use a 25 CIDR? Just set the AC66U to 192.168.4.1 with a mask of 255.255.255.0, the dlink as an access point and let the Asus assign the network IP addresses.

Sent from my P01M using Tapatalk

Hmm, whats wrong with /25 cidr? Its just personal preference and you can't auto assign ip address to a cascaded lan-lan router.

Anyway, factory reset the AC66U to 192.168.4.1 255.255.255.0, still same issue.

Does 'NAT Loopback' option under Firewall-General anything to do with this?

Kernel IP routing table                                                          
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface    
44.125.x.1      0.0.0.0         255.255.255.255 UH    0      0        0 eth0    
192.168.4.0     0.0.0.0         255.255.255.0   U     0      0        0 br0      
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun21    
44.125.x.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0    
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo      
0.0.0.0         44.125.x.1      0.0.0.0         UG    0      0        0 eth0

 

[blitzkrieg]

So I attempted add a static route for the LAN interface, still no go. Also for NAT Loopback; Asus or Merlin, have no effect.
Anybody any routing ideas?

Kernel IP routing table                                                         
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
44.125.x.1      0.0.0.0         255.255.255.255 UH    0      0        0 eth0
192.168.4.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
192.168.4.2     0.0.0.0         255.255.255.0   U     0      0        0 br0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun21
44.125.x.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         44.125.x.1      0.0.0.0         UG    0      0        0 eth0