In fact, let me edit this, what's really the issue here, it seems, turf the whole network diagram you had, connect your PC to the .2.x subnet interface on the windows box with a cable and now, can you talk to the .3.x subnet VM's? Once that's working, but this will exclude all the other hardware, AP's etc. then you can take it further. Obviously the WRT and the AP need to know that the .3.x subnet sits behind the 2.252? was it? "router" and same with the ERL, the default GW for eveything should point to the ERL, which knows how to escape your local network, but ideally all devices should also have a route to the .3.x network by way of the LAB server's .2.x IP address. Worst case scnario the ERL should have a route for this and thus should send redirects to any device talking to it, wanting to get to the .3.x IP addresses.