Debian 10 - static route doesn't override default

Question

My /etc/network/interfaces:

auto lo
iface lo inet loopback

auto wan
iface wan inet static
        address $myPublicIP
        netmask $ispSubnet
        gateway $ispGateway

auto vpn
iface vpn inet static
        address 10.102.1.194
        netmask 255.255.255.192
        up ip route add 192.168.10.32/27 via 10.102.1.196 dev vpn src 10.102.1.194 metric 10
        up ip route add 192.168.11.0/24 via 10.102.1.196 dev vpn src 10.102.1.194 metric 10

ip r shows as expected:

default via $wanGateway dev wan onlink 
$wanGateway/$wanCIDR dev wan proto kernel scope link src $wanIP 
10.102.1.192/26 dev vpn proto kernel scope link src 10.102.1.194 
192.168.10.32/27 via 10.102.1.196 dev vpn src 10.102.1.194 metric 10 
192.168.11.0/24 via 10.102.1.196 dev vpn src 10.102.1.194 metric 10 

But even after reboot, traffic goes via LAN (a.k.a vpn) gateway, 10.102.1.193/27:

traceroute to 192.168.11.2 (192.168.11.2), 30 hops max, 60 byte packets
 1  10.102.1.193 (10.102.1.193)  368.435 ms  368.370 ms  368.316 ms^C

This is Debian 10 LXC container under Proxmox VE 6.0-9. Is it the culprit, or am I missing something there? I tried this answer, but it didn't work for some reason - adding table and/or ip rule doesn't affect the outcome.

Answer 1

The fact that there's no route that has 10.102.1.193 as gateway being listed in ip r, and the fact that the interface name is vpn, makes me wonder if it's actually a tun (or anything of level/layer 3). In that case the via part of the routes wouldn't make a difference as there's no ARP/MAC involved.

For example with OpenVPN (with tun), the way to use a client as gateway is to enable client-to-client and add corresponding iroute for a route pushed (or configured on a client), so that the VPN server will know where (i.e. which client) to direct the traffics (instead of "letting it out" on its own host).

Though the VPN appears to be a multi-client setup, with that and OpenVPN you don't usually configure address in this way (as in fact, it requires you set iroute for the address, otherwise the server wouldn't even response to you ping through the tunnel). So perhaps this is purely my wild guess (or you are doing everything wrong).