Unable to send Internet traffic through Point to Site VPN on vpn gateway

First identify the gateway resource type: run Update-AzP2sVpnGateway only for a Virtual WAN Microsoft.Network/p2sVpnGateways resource; it does not apply to a conventional Microsoft.Network/virtualNetworkGateways VPN gateway.

Get-AzResource `
  -ResourceGroupName "rg-name" `
  -Name "vpngw-hub" |
  Select-Object Name, ResourceType, ResourceId

If the type is Microsoft.Network/p2sVpnGateways — Virtual WAN

This is the topology for which -EnableInternetSecurityFlag is documented. The flag configures P2S clients for forced tunneling, but it does not by itself provide an internet next hop. First configure one supported Virtual WAN egress method:

• Azure Firewall in the virtual hub with an Internet Traffic Routing Policy; or
• A 0.0.0.0/0 route in the hub default route table pointing through a virtual network connection to an NVA; or
• A branch that advertises 0.0.0.0/0.

Then enable the flag ^1^:

Update-AzP2sVpnGateway `
  -ResourceGroupName "rg-name" `
  -Name "vpngw-hub" `
  -EnableInternetSecurityFlag

The cmdlet updates a P2S VPN gateway under a Virtual Hub, and the parameter is scoped to its P2S connection configuration ^2^. It does not remove or reconfigure the six S2S connection resources.

However, shared hub routing changes can affect S2S traffic. In particular, routing intent and route-table associations can redirect branch traffic through the firewall. Before changing those:

1. Record each P2S, VNet, and S2S connection’s associated and propagated hub route tables.
2. Record effective routes for the P2S client pool and each branch prefix.
3. Configure the internet policy/default route without replacing the more-specific branch routes.
4. Test one P2S client and traffic through every S2S tunnel.
5. Roll back by removing the new routing policy/default route and, if necessary, running the corresponding -DisableInternetSecurityFlag.

Azure Firewall direct-access and forced-tunnel internet-routing modes are generally available in Azure Government ^3^.

After the change, download and reimport the P2S profile. For Windows Azure VPN Client forced tunneling, version 2.1900:39.0 or later is required, and the profile XML version must be 2 ^1^.

If the type is Microsoft.Network/virtualNetworkGateways — conventional VPN Gateway

Do not run Update-AzP2sVpnGateway. Your current behavior is expected: advertising 0.0.0.0/1 and [IP Address]/1 sends internet traffic into the tunnel, but VPN Gateway itself does not provide internet connectivity, so that traffic is dropped ^4^.

A Microsoft Q&A lab example routed P2S internet traffic through Azure Firewall by associating a route table with GatewaySubnet containing exactly:

• 0.0.0.0/1 → Virtual appliance → firewall private IP
• [IP Address]/1 → Virtual appliance → firewall private IP

It then allowed the P2S client pool through Azure Firewall so outbound traffic was translated to the firewall public IP ^5^. Configure application rules for the required HTTP(S)/FQDN destinations and network rules for any other required protocols.

The return path must also exist. If the firewall-side effective routes do not already show the P2S client pool through the VPN gateway, configure a route from the firewall path for the P2S client prefix with next hop Virtual network gateway ^6^.

This conventional-gateway pattern is a Q&A lab implementation, not a complete official reference architecture. Microsoft’s GatewaySubnet documentation explicitly says a 0.0.0.0/0 UDR is unsupported and warns that overlapping routes can affect control and data paths ^7^. Although the Q&A design uses two /1 routes rather than /0, validate its supportability for your exact Azure Government gateway SKU and routing configuration with Microsoft Support before production use.

Apply it in a maintenance window, preserve BGP propagation, and test all six S2S paths before and after. Rollback is to disassociate the new GatewaySubnet route table—or remove only its two /1 routes—and restore the previous firewall rules.

References

1. Configure forced tunneling for Virtual WAN Point-to-site VPN
2. Update-AzP2sVpnGateway-Description
3. Securing internet access with routing intent
4. Advertise custom routes for P2S VPN clients
5. Route internet traffic through P2S VPN - Microsoft Q&A
6. Point-to-Site Azure VPN Interesting Traffic - Microsoft Q&A
7. About VPN Gateway configuration settings