S2S VPN via a Virtual Gateway and Firewall Route table causing issues

Andy Walsh 56 Reputation points
2022-07-22T10:15:50.907+00:00

I have a S2S VPN via a Virtual Gateway. The Virtual Gateway is part of the VNET we have our Azure Firewall configured for.

The S2S VPN works fine and I can connect to the resources on the On-Premise side of the VPN from an Azure Machine within the VNET.

I would like all traffic to route through the Firewall from the Azure Machine, especially the traffic to the internet, but if I put a route of 0.0.0.0/0 on the Subnet of the Virtual Machine I can no longer connect to the resource on the On-Premise side of the VPN. I suspect it is because we have a Egress NAT on the S2S VPN due to overlapping Address range.

What routing configuration do I need to route traffic through the firewall and also over the VPN with the Egress NAT configured.

The Azure VNET Address = 10.10.0.0/16
The VM Subnet = 10.10.11.0/24
The Gateway Subnet = 10.10.0.0/24
The NAT Rule is Static - EgressSnat - 10.10.11.0/24 == 10.20.0.0/24

Without the 0.0.0.0/0 routing rule on the VM Subnet the VPN works fine. If I put the 0.0.0.0/0 route on that Subnet the VPN doesn't work, but without it I assume all the internet based traffic from the VM Subnet is not going through the firewall.

How can achieve both, the VPN working and the internet traffic going through the firewall.

I have seen reference to asymmetric routing mentioned in some articles and this could be causing the issue as the packet takes one path to the destination and another path on returning due to the Egress NAT. I’m just not sure how to fix this to get it working.

Any help or pointing in the right direction would be greatly appreciated.

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,516 questions
Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
656 questions
0 comments
Accepted answer
  1. Jackson Martins 10,151 Reputation points MVP
    2022-07-22T12:21:48.763+00:00

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy Walsh 56 Reputation points
    2022-07-22T11:56:32.293+00:00

    I've actually answered my own question with further testing and a bit of trial and error.

    I needed to add a route to the routing table for 10.20.0.0/24 (Egress NAT) to go back through the firewall.

    I think the problem was that the firewall was only seeing the outbound packets and the return packets were taking a different route so by forcing the traffic on the NAT Egress IPs back through the firewall it seems to work. Obvious when I think about it!

    2 people found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.