Internet acces via vWAN Azure

Hi @KrzysztofChwedynaWellDone-7604,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I am afraid I did not understand your environment or question here.

I see you have mentioned you are using S2S tunnel and would require internet access for remote users.
If your users are individual remote machines, connecting to Azure VPN gateway, then I believe you are referring to P2S connections.

For default route, 0.0.0.0/0, it is not mandatory that you have to use an Azure Firewall (i.e, Secured Hub).
You can use any NVA that you seem fit here as the NextHop.

Refer :
About virtual hub routing
How to configure virtual hub routing
Route traffic through an NVA
Route traffic through NVAs by using custom settings

I hope this helps.

Please let me know if my understanding of the issue is incorrect or if you have further queries on this.

Cheers,
Kapil

Hi @KapilAnanth-MSFT

I created a virtual machine with pfsesne(NVA) and created route table with nexthop to pfsense - this works only for Azure Vnet.
So, is it possible to support Internet access for the on-prem devices, over the S2S (egressing from Azure)?I don't see a place where I can route traffic for network s2s on prem.
Should it be done in virtual wan -> hubs-> Route Tables -> Default?

I would like to achieve such a result:
Local Network <->s2s<->Virtual Hub<->Pfsense<->VM Azure
Local Network <->s2s<->Virtual Hub<->Pfsense<->Internet

Hi @KrzysztofChwedynaWellDone-7604,

Yes, you are correct.
Any route updates should be done in vWAN -> Hubs-> Route Tables -> Default.

However, adding 0.0.0.0/0 here will not advertise the 0.0.0.0/0 across the VPN/Express Route Tunnel

• You should configure your OnPremises Firewall/VPN device to send 0.0.0.0/0 traffic to Azure Gateway.
• This should be done on the OnPrem side only.
• Once the traffic reaches Azure gateway, then the routes in Route table will make the Gateway forward the traffic to the NVA (Pfsense)
• Refer:
  Virtual hub routing preference
  About virtual hub routing
  How to configure virtual hub routing
  Create a Virtual WAN hub route table for NVAs: Azure portal

I hope this helps

Cheers,
Kapil

Thanks again for the hint, now my config looks good but internet traffic for s2s still doesn't work. Traffic to the Azure VM looks fine through pfsense, but when it does make it to the internet they create routing loops in which traffic never leaves the subnet.
I read that pfsense in a virtual machine cannot be NVA for my solution. Do I need to release traffic to create an NVA from a given marketplace?

Hi @KrzysztofChwedynaWellDone-7604,

Thanks for the update.

While only a certain NVAs are offered as default in vWAN, you can also use the Route tables to route traffic to any VM (in your case, your pfsense NVA).

Edit the route table and indicate the next hop as the specific IP of this NVA.
This should do the trick.

Refer: Workflow of Custom NVA