With Azure Express Route, is all outbound traffic from VMs (or other resources) routed via the on-premise network? As opposed to the traffic being routed directly to the internet based resource.

The reason I ask, is that there are articles on achieving forced tunnelling with site-to-site VPNs: https://blogs.msdn.microsoft.com/kishorerajendran/2015/05/09/microsoft-azure-forced-tunneling-redirecting-all-internet-traffic-through-on-premise-location/

Do you just get this out of the box so to speak with Express Route?



By default when you setup Express Route there is a default route advertised to allow all outbound traffic to go directly out to the internet from Azure resources. However it is possible to add a User Defined Route (UDR) to instead route this traffic via your corporate network and out to the internet via your corporate resources.

There's a good example of setting this up here, it's for App Services rather than VM's but the principal is the same.


As Sam said, by default there is a default route advertised to allow Azure resources' outbound traffic to go directly out to the internet.

Also, you can advertise default routes ( to block all internet connectivity to virtual machines deployed within a virtual network and route all traffic out through the ExpressRoute circuit.

By the way, if you advertise default routes, we will force traffic to services offered over public peering (such as Azure storage and SQL DB) back to your premises. You will have to configure your routers to return traffic to Azure through the public peering path or over the internet. More information about ExpressRoute, refer to the link.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.