How to allow internet traffic From Azure to on-premises pFsense firewall using Azure VWAN connection ?

@Allan Solomon Mejia please Give me an update. So i can check further

Hello @Sajin C S

To route internet-bound traffic from Azure through an on-premises pfSense firewall over Azure Virtual WAN, you'll need more than just an IPsec connection.

A few things to verify:

• Forced tunneling must be configured so the Azure workload's default route (0.0.0.0/0) is advertised toward the Virtual WAN hub and ultimately to the VPN connection.
• Route propagation in the Virtual WAN hub should include the default route from the branch (pfSense). Confirm the effective routes on the spoke VNet or VM to ensure 0.0.0.0/0 points to the vHub.
• On pfSense, verify that IP forwarding, outbound NAT (if required), and firewall rules allow forwarded internet traffic from the Azure address space.
• Ensure the VPN connection and BGP (if enabled) are correctly exchanging routes. If you're using static routing, verify that the default route is configured correctly on both sides.
• If Internet Security is enabled on the Virtual WAN hub with Azure Firewall or a Secure Virtual Hub, Azure may direct internet-bound traffic there instead of the VPN tunnel.

Could you share:

• Is the VPN connection using BGP or static routes?
• Is Internet Security enabled on the Virtual WAN hub?
• Are you trying to route all internet traffic (0.0.0.0/0) through pfSense, or only specific public destinations?
• Is the tunnel up, and can Azure already reach your on-premises private subnets?

These details will help determine whether the issue is with routing, route propagation, or NAT.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.