I set up a Virtual Network on Azure a few days ago and connected our local business Network through a site-to-site VPN Connection with the virtual network. Everything is working fine so far. Then I also set up a Point-to-site VPN connection with my personal computer to connect to the virtual network of azure. This went also fine. I can now reach:

  • all ressources from the Virtual Network from our business location
  • all ressources from the business location from our virtual network
  • all ressources from the Virtual Network from my computer connected through P2S

But I can not

  • reach the ressources from our business location through my computer connected through P2S VPN.

I already found some articles:

  • Accordingly to this Microsoft Docs article, I just need to add a route on my personal computer, but I have no idea which addresses I have to type in. I tried several combinations but whithout any success.
  • I also found this serverfault article, but I have no clue, which IP Adress I have to type in.

Following are some informations about my setup:

  • I enabled BGP for the Site-to-Site Connection
  • On the business location, I'm using a EdgeRouter6P which is configured accordingly to this setup

and some addresses:

  • Business Location Public IP:
  • Business Location Subnet:
  • Business Location BGP-Peers:
  • Virtual Network Public IP:
  • Virtual Network Subnet:
  • Virtual Network BGP-Peers:
  • Virtual Network Gateway Subnet:
  • Address Pool P2S VPN Clients:

When I start a tracert command on my personal computer i get the following output:

1   4ms  3ms   2ms
2 475ms 47ms 316ms
3   *     *    *   Timeout

I'm thankful for any advice or hint.


I added the following route:

route add mask

and the tracert output was

Routenverfolgung zu über maximal 30 Hops

  1     *        *        *     Zeitüberschreitung der Anforderung.

than I added the route

route add mask

the tracert output was the following:

Routenverfolgung zu über maximal 30 Hops

  1     4 ms     1 ms     1 ms  internetbox.home []
  2     2 ms     3 ms     3 ms []
  3     8 ms     3 ms     7 ms

It seems that with the second method, all the traffic is routed over the internet.


If I understand correctly, you will need to manually instruct your local machine (in the P2S network) that to get to your business network it has to go across the Azure network via the Azure gateway. You've mentioned "Virtual Network Public IP" but I believe this should be VNet Gateway IP? You should be able to use either the public IP ( or private IP (should be the first entry in the subnet, ie

As you found in the Microsoft Docs link you mentioned, you need to add a manual route, which you do by editing the routes.txt file %AppData%\Microsoft\Network\Connections\Cm\**yourGuid**\routes.txt

This file uses syntax route add <address> <mask> <gateway>.

So I believe in your case this will be:

route add MASK (using public IP)


route add MASK (using private IP)

Assuming your Azure VNet gateway is set up correctly it should know about your business IP range and forward the traffic correctly. You mentioned you're using a EdgeRouter which can be found under supported devices with associated policy and configuration guides, your 6P will require firmware 1.10.x which can be downloaded on the Ubiquiti Downloads page. You can then download the setup script from the Azure portal by clicking on your 'connection' resource, and then the 'Download configuration' button.

| improve this answer | |
  • Hi Jason. Thank you very much for your answer. I tried both of your suggestested answers, but none of them is working and I don't know why. I attached you the tracert output for both variants in my original question above. Do you have another idea what I did wrong? – M4SX5 Dec 3 '19 at 18:23
  • And yes, you understood me completely right. That's what I'm trying. – M4SX5 Dec 3 '19 at 18:33
  • I've added some more info on how to configure your on-prem device connection to Azure in case that is the issue – Jason Dec 5 '19 at 3:57
  • Thank you for the detailed information. I followed the instructions you supplied, but I've still the same issue. The VPN on the Business Location is working fine, as I can access all ressources from the virtual network. Also can I access all ressources on the Business location from my VM. Only from my P2S Client I cannot access the ressources from the business location. Do you think I have to set up a routing table in Microsoft Azure, and if so, how? – M4SX5 Dec 6 '19 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.