I did have a good hunt around for a similar post but couldn't find the same scenario. I am trying to connect to a 3rd party URL from an on-prem machine, through Azure. So:

on-prem -> (point-to-site) -> Azure VPN Gateway -> (site-to-site) -> 3rd party URL

  • Point to site address space:
  • Azure vnet address space:
  • 3rd party address space:

I have put a VM in the Azure network as a middleman for testing, and I can connect from on-prem to the VM, and from the VM to the 3rd party site, however for some reason I can't get all the way through. The weirdest part is that the 3rd party IP resolves correctly from the hostname, I just can't connect to the URL (it's HTTPS/443 if that matters). If I run a tracert from on-prem I can see that 'tracert VM' first hop goes straight to the VPN gateway, however 'tracert 3rdparty' goes to my router->isp->fail, so it seems my routing is messed up somehow.

I would have thought this would be pretty standard routing for the VPN gateway, but hopefully there's a way to make this work as it's vital to the project I'm working on. I'm happy to try custom routes, or whatever it takes. Appreciate any suggestions.

  • I'm pretty sure the routing is not automatic with the VPN gateways, so you may need to actually build a router in Azure and have that forward the packets. – Todd Wilcox Nov 22 '17 at 21:51

Thanks for the replies. After playing around a bit and some help from Microsoft support, apparently what I had to do was enable BGP on both gateways (Azure and 3rd party), and add a custom route on my on-prem machine.

To add the custom route, after downloading the VPN client from the Azure portal from the VPN Gateway blade and unzipping and installing, edit the routes.txt file %AppData%\Microsoft\Network\Connections\Cm\yourGuid\routes.txt. Add a route to the 3rd party network address space (in my case that goes through the Azure router (

In our case we also wanted Azure web apps to be able to do the same thing through integrating with the VNet, in which case we also had to uncheck the 'IKEv2 VPN' checkbox in the Azure gateway point-to-site blade.

| improve this answer | |
  • I would make a comment, but I have not enough reputation yet. Sorry... I came along a similar problem. I don't know to which IP adresse I have to route my traffic. So, where can I (or did you) find the address of the azure router? – M4SX5 Nov 29 '19 at 8:34
  • M4SX5 It's been a long time since I posted this, and the new gateways are slightly different, but when you create a VPN gateway you assign it to a public IP resource (new or existing). From memory your routes.txt file would have route add <address> <mask> <gateway> so in this case route add MASK – Jason Dec 3 '19 at 2:08
  • @Jason do you have the information required for the BGP element of the fix? I have a Draytek router on-premise and can't get from client P2S VPN to the on-premise infrastructure, I can only hit the azure machines. – Lucero79 Dec 4 '19 at 10:35
  • Can you ping from the Azure machine to on-prem router or machines? Double check your NSGs to ensure traffic (especially ICMP for testing ping) is allowed. – Jason Dec 5 '19 at 4:04
  • Sorry for slow reply, Yes. If I am in Azure, I can ping the on-prem machines, even RDP to them, and from on-prem to Azure. The issue is when the clients connect via VPN to Azure. They can see/ping/rdp Azure, but not on-prem. Annoying! – Lucero79 May 26 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.