title: GCE + OpenVPN + subnetwork does not work the routing
body: <p>I want to create a Private network in google compute platform where I will be able to enter only using a vpn.
  So, I create a machine in GCE and I install openvpn. This machine has an static IP, the ssh port open and the default network configuration from GCE.
  Then, I create a second machine (call it MachineA) , in the same network, but without external IP.
  Then I create the route rule in order to redirect traffic from vpn-machine to another internal instances.</p>
  
  <p>I'm able to connect from my machine to the vpn. 
  I'm able to ping to vpn machine.
  I'm able to ping to MachineA.
  I'm able to ssh to vpn machine.
  I'm able to ssh to MachineA.</p>
  
  <p>but...
  When I connect to ssh vpn machine and run gsutil it works, also ping to 8.8.8.8
  When I connect to ssh MachineA and run gstult or ping 8.8.8.8 does not work.</p>
  
  <p>Any Idea what Im doing wrong ?</p>
  
  <p>Some information</p>
  
  <p><strong>from VPN-machine</strong></p>
  
  <pre><code>xxx@dev-vpn:~$ netstat -rn
  Kernel IP routing table
  Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
  0.0.0.0         10.240.10.1     0.0.0.0         UG        0 0          0 eth0
  10.16.0.0       10.16.0.2       255.255.255.0   UG        0 0          0 tun0
  10.16.0.2       0.0.0.0         255.255.255.255 UH        0 0          0 tun0
  10.240.10.1     0.0.0.0         255.255.255.255 UH        0 0          0 eth0
  
  xxx@dev-vpn:~$ traceroute 10.240.10.3
  traceroute to 10.240.10.3 (10.240.10.3), 30 hops max, 60 byte packets
   1  * * instance-1.c.project.internal (10.240.10.3)  1.188 ms
  </code></pre>
  
  <p><strong>from MachineA</strong></p>
  
  <pre><code>traceroute to 10.240.10.2 (10.240.10.2), 30 hops max, 60 byte packets
   1  * * *
   2  * * dev-vpn.c.project.internal (10.240.10.2)  0.899 ms
  
  traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
   1  * * *
   2  * * *
   3  * * *
   4  * * *
   5  * * *
  
  Kernel IP routing table
  Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
  0.0.0.0         10.240.10.1     0.0.0.0         UG        0 0          0 eth0
  10.240.10.1     0.0.0.0         255.255.255.255 UH        0 0          0 eth0
  </code></pre>
  
  <p>In google networking I add this rule
  vpn-routing 10.16.0.0/24    1001    None    dev-vpn (Zone us-central1-a)</p>