Windows client can't ping Vyos router when ip assigned with dhcp

Greetings!
My windows client cannot ping an interface on Vyos when configured via dhcp, but a static ip config, it can! I’ll post the Vyos config below, but first the topology, and client details.

I have a hardware router defined as 172.16.4.1/24, serving dhcp and connected to the internet. This serves ‘normal’ laptops and desktops. There is also a VM esxi host which runs vyos.

The Vyos guest has two eth interfaces (172.16.4.2 & 172.16.9.1). My plan is to have one interface available to NAT to the outside world, the other to be an internal only network.

When I connect the client to the network via dhcp, I cannot ping 172.16.9.1. I think that makes sense. When I add 172.16.4.2 (vyos) as a second gateway to the client config , it still cannot ping 172.16.9.1, but I can get to 172.16.4.2 (vyos). I even tried adding 172.16.9.1 as a third gateway - no dice.
I thought that if I could get to the vyos router it would route to the requested interface…

Here’s where it gets strange - if I change the windows client network config to a static ip, on the 172.16.4 network, then all pings work fine!

dazed and confused,
phil

(the 172.16.1.0/24 network is not used)
vyos@vyos:/var/log$ show int eth
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- — -----------
eth0 172.16.4.2/24 u/u VYOS Router
eth1 172.16.1.1/24 A/D 161-network
eth2 172.16.9.1/24 u/u 169-network

vyos@vyos:/var/log$ show config
interfaces {
    ethernet eth0 {
        address 172.16.4.2/24
        description "VYOS Router"
        duplex auto
        hw-id 00:0c:29:7f:cf:38
        smp_affinity auto
        speed auto
    }
    ethernet eth1 {
        address 172.16.1.1/24
        description 161-network
        disable
        duplex auto
        hw-id 00:0c:29:7f:cf:42
        smp_affinity auto
        speed auto
    }
    ethernet eth2 {
        address 172.16.9.1/24
        description 169-network
        duplex auto
        hw-id 00:0c:29:7f:cf:4c
        smp_affinity auto
        speed auto
    }
    loopback lo {
    }
}
nat {
    destination {
    }
    source {
        rule 10 {
            outbound-interface eth0
            protocol all
            source {
                address 172.16.4.0/24
            }
            translation {
                address masquerade
            }
        }
        rule 15 {
            outbound-interface eth0
            protocol all
            source {
                address 172.16.1.0/24
            }
            translation {
                address masquerade
            }
        }
    }
}
protocols {
    static {
    }
}
service {
    dns {
        forwarding {
            cache-size 0
            listen-on eth0
            name-server 172.16.4.1
            name-server 75.75.75.75
            name-server 8.8.8.8
        }
    }
    ssh {
        port 22
    }
}
system {
    config-management {
        commit-revisions 20
    }
    console {
    }
    gateway-address 172.16.4.1
    host-name vyos
    login {
        user vyos {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
            }
            level admin
        }
    }
    name-server 172.16.4.1
    name-server 8.8.8.8
    ntp {
        server 0.pool.ntp.xxx {
        }
        server 1.pool.ntp.xxx {
        }
        server 2.pool.ntp.xxx {
        }
    }
    package {
        auto-sync 1
        repository community {
            components main
            distribution helium
            password ****************
            url http://packages.vyos.net/vyos
            username ""
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone UTC
}

Thanks. I realized the main router is simply not routing to the vyos router. A static entry in the 4.1 router’s table fixed it.