How would I get this routing to work between the two subnets? Unsure if i am over-complicating my network

Question

I am attempting to operate 2 subnets, the first subnet on range 192.168.0.0/24 is free to access anything it wants, including machines on the second subnet. the second subnet on range 10.0.0.0/24 is restricted to only being able to access the outside world. I do not want machines with a source within 10.0.0.0/24 to be able to access machines in the 192.168.0.0/24 range but i do want it to be able to go outside.

On top of this, in the 192.168.0.0/24 range i also want 2 gateways, the first being the default gateway (currently in the form of an Ubuntu VM) which routes traffic via a vpn, its address is 192.168.0.250 and the second gateway (which is the internet-facing TP-Link wireless router) at 192.168.0.1 (also the DHCP & DNS server for the 192.168.0.0/24 range)

I also have a third gateway for bridging the two subnets, another Ubuntu VM with 2 NICS, the first being 192.168.0.251 and the second being 10.0.0.1

Now that I have explained the network i want, here is my setup and what i am experiencing:

Ubuntu VM on 192.168.0.250

the route table on 192.168.0.250 looks like this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.8.0.1        128.0.0.0       UG    0      0        0 tun0
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.0.0.0        192.168.0.251   255.255.255.0   UG    0      0        0 eth0
10.8.0.0        *               255.255.0.0     U     0      0        0 tun0
128.0.0.0       10.8.0.1        128.0.0.0       UG    0      0        0 tun0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
.               192.168.0.1     255.255.255.255 UGH   0      0        0 eth0

I add the routes via

 ip rule add from 192.168.0.0/24 table default
 ip route add 10.0.0.0/24 via 192.168.0.251
 ip rule add from 10.0.0.0/24 table sandboxgateway
 ip route add default via 192.168.0.1 dev eth0 table sandboxgateway

If i remove the two sandboxgateway lines i can access 10.0.0.1 but anything in the 10.0.0.X range is accessing the internet through the VPN, which is not what i want. and its iptable looks like this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Ubuntu VM on 192.168.0.251/10.0.0.1

the route table on 192.168.0.251(eth0)/10.0.0.1(eth1) looks like this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     255.255.255.255 UGH   0      0        0 eth0
default         192.168.0.250   0.0.0.0         UG    0      0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 eth1
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0

and its iptable looks like this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  10.0.0.0/24          192.168.0.0/24

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

The issue

The issue I am having is that while my machine at 192.168.0.2 can access the outside world either via 192.168.0.1 or 192.168.0.250 as its gateway, as can my machine at 10.0.0.10 access the outside world without accessing anything at 192.168.0.X, my machine at 192.168.0.2 cannot access either 10.0.0.1 or 10.0.0.10, and a tracert from the windows command prompt results in

Tracing route to 10.0.0.1 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.0.250
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.

Why is 192.168.0.250 not routing to 192.168.0.251??

Apologies if i have included too much or too little information, please ask if any additional details are needed to answer this question.

Answer 1

The iptables packetfilter drops the responses of the 10.0.0.0/8 ips to the 192.168.0.0/8 IPs. Add a rule to allow packets from 10.0 to 192.168 that are already established, before the DROP rule:

-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

That should do the trick. If not, remove the DROP rule to check if that is really the origin of the problem. If so, you might have to build a more sophisticated ruleset.