Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you would like to know if Azure VPN gateway can provide transit connectivity to your OnPrem networks.
Yes, Azure VPN Gateways with BGP enabled S2S Connections, will enable transit connectivity between your sites.
This is documented here : Transit routing between your on-premises networks and multiple Azure VNets
The recommended approach to prevent this, is, as you stated,
- to use NSG for workloads in VNet.
- And for servers in OnPremises, you must have Firewalls in place so that they only talk to the expected destination servers.
- Also, you can disable BGP for the S2S Connections - and this will prevent Transit routing.
Hope this helps. Kindly let us know if you need further assistance on this issue.
Thanks,
Kapil
Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.