Возможность соединения OpenVPN выходит с внутренней подсетью

Я имею, устанавливают сервер VPN в VLAN с внутренней подсетью. На сервере VPN настроена одна VPN с помощью IPSec, который может соединиться с внутренней подсетью.

Дополнительный я установил OpenVPN-сервер, но клиенты не могут соединиться с внутренней подсетью. Конфигурация сервера:

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "route 10.16.0.0 255.255.0.0"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

Внутренняя подсеть является 10.16.0.0/16.

traceroute от клиента подключения к IP-адресу во внутренней подсети показывает следующий вывод:

traceroute to 10.16.15.13 (10.16.15.13), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  1.867 ms  1.757 ms  1.677 ms
 2  * * *
 3  * * *

Внешнее соединение со связанным клиентом работает.

Вывод от ip route list:

0.0.0.0/1 via 10.8.0.1 dev tun0 
default via VM-GATEWAY dev ens3 
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.4 
10.16.0.0/16 via 10.8.0.1 dev tun0 
VM-GATEWAY dev ens3 scope link 
128.0.0.0/1 via 10.8.0.1 dev tun0 
VM-IP via VM-GATEWAY dev ens3 

Outfrom от ifconfig на openvpn сервере:

ens19: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet OPENVPN-HOST-IP  netmask 255.255.255.248  broadcast OPENVPN-HOST-GATEWAY
    inet6 fe80::9883:beff:fe99:305e  prefixlen 64  scopeid 0x20<link>
    ether 9a:83:be:99:30:5e  txqueuelen 1000  (Ethernet)
    RX packets 6500104  bytes 3982668113 (3.7 GiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 7271114  bytes 4037705401 (3.7 GiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
    inet 127.0.0.1  netmask 255.0.0.0
    inet6 ::1  prefixlen 128  scopeid 0x10<host>
    loop  txqueuelen 1  (Lokale Schleife)
    RX packets 0  bytes 0 (0.0 B)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 0  bytes 0 (0.0 B)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1280
    inet 192.168.42.1  netmask 255.255.255.255  destination 192.168.42.10
    ppp  txqueuelen 3  (Punkt-zu-Punkt-Verbindung)
    RX packets 208705  bytes 28271807 (26.9 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 189459  bytes 120966692 (115.3 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
    inet 10.16.0.1  netmask 255.255.0.0  destination 10.16.0.1
    inet6 fe80::f8ab:a6e:149f:eec4  prefixlen 64  scopeid 0x20<link>
    unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
    RX packets 269  bytes 19394 (18.9 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 7  bytes 336 (336.0 B)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Вывод от iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Вывод от ip addr list:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens18: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 6e:3e:98:f6:26:2f brd ff:ff:ff:ff:ff:ff
3: ens19: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 9a:83:be:99:30:5e brd ff:ff:ff:ff:ff:ff
    inet OPENVPN-HOST-IP/29 brd OPENVPN-BROADCAST-IP scope global ens19
       valid_lft forever preferred_lft forever
    inet 10.16.0.2/16 scope global ens19
       valid_lft forever preferred_lft forever
    inet6 fe80::9883:beff:fe99:305e/64 scope link 
       valid_lft forever preferred_lft forever
5: ip_vti0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1
    link/ipip 0.0.0.0 brd 0.0.0.0
10: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qdisc pfifo_fast state UNKNOWN group default qlen 3
    link/ppp 
    inet 192.168.42.1 peer 192.168.42.10/32 scope global ppp0
       valid_lft forever preferred_lft forever
13: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.16.0.1/16 brd 10.16.255.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::4ef6:f672:4240:6eef/64 scope link flags 800 
       valid_lft forever preferred_lft forever

Содержание /etc/openvpn/openvpn-status.log:

OpenVPN CLIENT LIST
Updated,Tue Nov 27 19:38:12 2018
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
vm-monitoring,CLIENT-IP:53718,4883,3650,Tue Nov 27 19:38:05 2018
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.16.0.2,vm-monitoring,CLIENT-IP:53718,Tue Nov 27 19:38:07 2018
GLOBAL STATS
Max bcast/mcast queue length,1
END

У Вас есть идея, как я могу устранить эту проблему?