I have a VNet with on-premise S2S VPN and forced tunneling configured. This is the hub for my hub-spoke network where the spoke networks are Vnet peered to the Hub. I would like to know how I can enforce 'forced tunneling' for the peered spoke Vnets. Do I need to create a route in each subnet for 0.0.0.0/0 traffic with next hop 'Virtual network gateway'?
Do I need to create a route in each subnet for 0.0.0.0/0 traffic with next hop 'Virtual network gateway'?
Yes, you should add the route rule AddressPrefix "0.0.0.0/0" and NextHopType VirtualNetworkGateway for each of subnets. Then any outbound connections from these subnets to the Internet will be forced or redirected back to an on-premises site via the S2S VPN tunnels.
Ref: Configure forced tunneling using the Azure Resource Manager deployment model