Routing traffic to another IP (belongs to my country)

Question

Routing traffic to another IP (belongs to my country)

Captain56022 25

Hello,

I’m dealing with an Azure networking issue and would appreciate some guidance.

My Setup:

-One Azure VM

-Azure Firewall Premium (same region as the VM)

-Site-to-Site IPsec VPN to my on-prem Fortigate

Three specific websites that block traffic from Azure because the source IP is outside my country

My Goal:

I want this Azure VM to access only these three websites, which currently block any connection that does not originate from my country.

Thanks

Captain56022 25 Reputation points

2025-11-28T20:35:24.4+00:00

Thanks for the explanation.

Just to clarify my requirement:

I only need my Azure VM to access three specific websites from my country IP address.

All other websites can be accessed normally — I don’t mind which outbound IP is used for them.

So the goal is simply to route those three domains through my on-prem Fortigate, while the rest of the traffic can stay as-is.
Venkatesan S 1,165 Reputation points Microsoft External Staff Moderator

2025-11-28T20:45:53.1466667+00:00
Hi Captain56022,

So the goal is simply to route those three domains through my on-prem Fortigate, while the rest of the traffic can stay as-is.

To meet your requirement, you don’t need full forced tunneling. You only need to route traffic for those three specific websites through your on-prem Fortigate (so they use your country IP), while all other websites continue to use the normal Azure outbound IP. This is done using selective routing.

Find the public IP address of each website using nslookup.

In the VM subnet route table, add one UDR per website:<website-IP>/32 → Next hop: Virtual network gateway

On your Fortigate firewall, allow outbound access to those IPs. This ensures those sites see your country IP.

Do not add a default route; this keeps the rest of the internet traffic going out directly from Azure as usual.

Azure virtual network traffic routing | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Captain56022 25 Reputation points

2025-12-05T11:20:48.6033333+00:00

Thank you very much for your helpful assistance, the issue was resolved thanks to you.
Venkatesan S 1,165 Reputation points Microsoft External Staff Moderator

2025-12-05T11:26:37.38+00:00

Please do not forget Accept and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Kindly let us know if the above helps or you need further assistance on this issue.

Answer accepted by question author

0 additional answers

Your answer

Captain56022 25 Reputation points

2025-11-28T20:35:24.4+00:00

Thanks for the explanation.

Just to clarify my requirement:

I only need my Azure VM to access three specific websites from my country IP address.

All other websites can be accessed normally — I don’t mind which outbound IP is used for them.

So the goal is simply to route those three domains through my on-prem Fortigate, while the rest of the traffic can stay as-is.
Venkatesan S 1,165 Reputation points Microsoft External Staff Moderator

2025-11-28T20:45:53.1466667+00:00

Hi Captain56022,

So the goal is simply to route those three domains through my on-prem Fortigate, while the rest of the traffic can stay as-is.

To meet your requirement, you don’t need full forced tunneling. You only need to route traffic for those three specific websites through your on-prem Fortigate (so they use your country IP), while all other websites continue to use the normal Azure outbound IP. This is done using selective routing.

Find the public IP address of each website using nslookup.

In the VM subnet route table, add one UDR per website:<website-IP>/32 → Next hop: Virtual network gateway

On your Fortigate firewall, allow outbound access to those IPs. This ensures those sites see your country IP.

Do not add a default route; this keeps the rest of the internet traffic going out directly from Azure as usual.

Azure virtual network traffic routing | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Captain56022 25 Reputation points

2025-12-05T11:20:48.6033333+00:00

Thank you very much for your helpful assistance, the issue was resolved thanks to you.
Venkatesan S 1,165 Reputation points Microsoft External Staff Moderator

2025-12-05T11:26:37.38+00:00

Please do not forget Accept and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Kindly let us know if the above helps or you need further assistance on this issue.

Answer 1

Hi Captain56022,

Thanks for posting question in Microsoft Q&A.

I want this Azure VM to access only these three websites, which currently block any connection that does not originate from my country.

You want your Azure VM to access only three websites, but those sites block traffic coming from Azure IP addresses because they're outside your country. To get around this, your VM needs to go out to the internet using your on-premises public IP the one that the websites trust.

Steps:

VM subnet UDR: 0.0.0.0/0 → Next hop Virtual network gateway
Enable BGP on VPN; Fortigate advertises 0.0.0.0/0
Azure Firewall App Rule: Allow HTTPS (443) from VM subnet to the 3 FQDNs only, Deny All below

Your VM can now reach the geo-blocked sites securely, and nothing else on the internet is accessible.

Reference:

To meet your requirement, you don’t need full forced tunneling. You only need to route traffic for those three specific websites through your on-prem Fortigate (so they use your country IP), while all other websites continue to use the normal Azure outbound IP. This is done using selective routing.

Find the public IP address of each website using nslookup.
In the VM subnet route table, add one UDR per website:<website-IP>/32 → Next hop: Virtual network gateway
On your Fortigate firewall, allow outbound access to those IPs. This ensures those sites see your country IP.

Do not add a default route; this keeps the rest of the internet traffic going out directly from Azure as usual.

Please do not forget Accept and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Routing traffic to another IP (belongs to my country)

0 additional answers

Your answer