Want to route on-prem traffic to internet through azure firewall

Thanks for your input. Below are my comments on your inputs,

2.Use Hub-Spoke topology with UDRs

• Place Azure Firewall in a dedicated subnet (e.g., AzureFirewallSubnet) in the Hub VNet.
  • Firewall placed in the dedicated firewall subnet in the hub.
• Apply UDRs to other subnets (spoke VNets or on-prem routes via BGP) with next-hop set to Azure Firewall private IP.
  • We only have only have Hub vnet with two subnnets (Gateway subnet and firewall subnet). We dont have any spoke vnet deployed.
  • We want to route traffic from gatewaysubnet to firewall within the hub vnet itself.

3.Enable BGP route propagation on the GatewaySubnet

• This allows the gateway to advertise the forced-tunneling routes to on-premises without breaking gateway functionality.
  • We have enable route propagation on the route table. We dont see any setting on GatewaySubnet to enable BGP route propagation. Please share the guide to do this.

Hi @GAWAI, SRIKANT,

Even if both the ExpressRoute gateway and Azure Firewall are deployed in the same hub VNet, Azure does not support routing traffic from the GatewaySubnet to any NVA or firewall, including Azure Firewall.

Reason (by design)

• GatewaySubnet is reserved for gateway control‑plane and data‑plane operations.
• Applying UDRs (particularly 0.0.0.0/0) would break gateway connectivity, BGP, and management traffic.
• Azure explicitly blocks default routes and custom UDRs on the GatewaySubnet.

Forced tunneling with Azure Firewall in an ExpressRoute scenario does NOT rely on UDRs on the GatewaySubnet or workload subnets.

Instead, it works as follows:

• Azure advertises a default route (0.0.0.0/0) to on‑premises via BGP
• On‑premises sends Internet‑bound traffic to Azure over ExpressRoute
• Azure Firewall processes this traffic and performs outbound SNAT to the Internet

This behavior is BGP‑based and does not involve subnet‑level routing on the GatewaySubnet.

Reference: https://learn.microsoft.com/en-in/azure/firewall/forced-tunneling

Supported traffic flow :

On‑prem → ExpressRoute Gateway → Azure Firewall → Internet

On BGP route propagation

• BGP is enabled on the ExpressRoute gateway, not on subnets.
• “Route propagation” is a route table setting, not a subnet setting.
• Since GatewaySubnet cannot have a route table, there is no route‑propagation option available for it.

You can’t route traffic from the GatewaySubnet using UDRs—this is blocked by design. For ExpressRoute, Azure Firewall Internet breakout works via BGP advertising 0.0.0.0/0 to on‑premises, not by applying routes on the GatewaySubnet.

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thank you, Thanmayi, for your comments.

Instead of creating a spoke VNet and subnet and applying a default UDR to the spoke subnet, can we apply the default UDR to the default subnet in the hub VNet to route traffic to the Azure Firewall? Will that work?

Here are the steps:

We have a hub VNet with three subnets: Default, GatewaySubnet, and AzureFirewallSubnet.

Traffic coming from on-premises will ultimately reach the GatewaySubnet in the hub VNet.

Apply a default route (0.0.0.0/0) to the default subnet, with the next hop set to the firewall.

From the firewall, traffic flows to the internet.

Please suggest if this approach will work or if any corrections are needed.

Hi @SRIKANT GAWAI,

Thank you for the clarification.

No, applying a default UDR (0.0.0.0/0) to the Default subnet in the hub VNet will not work for routing on-premises traffic through Azure Firewall. User-defined routes only apply to traffic originating from resources within the associated subnet. Traffic coming from on-premises over ExpressRoute enters Azure via the GatewaySubnet and is not affected by UDRs applied to other hub subnets.

Since Azure does not support associating a default route with the GatewaySubnet, this approach cannot be used to achieve forced tunneling. To route on-premises Internet-bound traffic through Azure Firewall, default routes must be applied to workload subnets (typically in spoke VNets), while keeping the GatewaySubnet unchanged.

Thank you, Thanmayi, for your comments.

I have already applied default route to the spoke subnet. The traffic from the on-premises reaching upto express route circuit only. How should I route that traffic from circuit to firewall now so that it can go out to the internet.