Is it possible to connect the internet in vpn gateway forced tunneling

Hi 대진 최,

Welcome to Microsoft Q&A and thank you for posting your query here!

You actually configured almost everything correctly, but the part that breaks your Internet access is the routing on the AzureFirewallSubnet. This behavior is expected based on the Microsoft documentation for both Azure Firewall Forced Tunneling and VPN Gateway Forced Tunneling.

Here’s what went wrong and how to fix it.

Why Private Routing Works but Internet Does Not

You configured your flow like this:

VM → Azure Firewall → VPN Gateway → On-Prem Firewall → Internet

But according to Microsoft, Azure Firewall cannot send Internet-bound traffic to a VPN Gateway. Only private prefixes should ever go through the VPN gateway.

Microsoft doc: Azure Firewall Forced Tunneling

The doc clearly states:

• The Firewall management plane must not be forced-tunneled

The Firewall data plane may be forced-tunneled, but only for private traffic, not for Internet

The Firewall still requires direct Internet access for Azure platform services (updates, DNS, health, monitoring)

Because you applied: AzureFirewallSubnet → 0.0.0.0/0 → VirtualNetworkGateway

The firewall is effectively “blind” to Azure’s required outbound services and therefore cannot pass Internet traffic.

Primary Issues

1. Azure Firewall Subnet is incorrectly forced to the VPN Gateway

This breaks the Azure Firewall’s ability to reach Azure infrastructure.

2. Internet traffic cannot be routed through VPN Gateway

Azure does not support routing Internet-bound flows from Azure Firewall → VPN Gateway → On-Prem → Internet. Only private prefixes should be routed over S2S.

3. Asymmetric routing occurs

Return Internet traffic does not come back through the Firewall, so it is dropped.

4. On-prem firewall would require NAT for Azure

If Internet egress is done on-prem, on-prem must NAT Azure networks. This isn’t configured, so return traffic is lost.

Correct Microsoft-Supported Architecture

1. VM Subnet UDR

0.0.0.0/0 → Azure Firewall private IP

2. AzureFirewallSubnet UDR

• Remove → 0.0.0.0/0 → VirtualNetworkGateway
• Restore default system route for Internet
• Add only private routes to the VPN gateway:

Examples:10.x.x.x/xx → VirtualNetworkGateway

192.168.x.x/xx → VirtualNetworkGateway

172.16.x.x/xx → VirtualNetworkGateway

3. AzureFirewallManagementSubnet

This is correct: 0.0.0.0/0 → Internet

4. Resulting flow (Microsoft recommended)

Private traffic VM → Firewall → VPN Gateway → On-Prem

Internet traffic VM → Firewall → Internet (direct)

Why This Fixes Everything

• Azure Firewall regains necessary Internet access for platform operations
• Internet-bound flows no longer get misrouted through VPN
• Asymmetric routing disappears
• Private S2S routing continues to work through VPN
• Architecture aligns exactly with Microsoft’s forced tunneling guidance
• Nothing is wrong with your VM or Firewall policies — the issue is the 0.0.0.0/0 UDR on the AzureFirewallSubnet pointing to the VPN Gateway.
• Remove that route, route only private prefixes through S2S, and keep the Firewall’s own outbound access direct to the Internet. After that, your VMs will be able to browse the Internet normally.

i hope the above response helps, if not please do let me know if you have any questions on this.

Thanks,

Harish.