the .3 network most likely is not aware of the VPN IP range (.2) ; you can use either use masquerading to hide the VPN IPs or you can set up a return route on the default GW of the .3 network similar to
route add -net 192.168.2.0/24 gw 192.168.3.X
where <X> is the LAN IP of the VPN server.
