@Shawn Morrissey Thank you for reaching out to Microsoft Q&A.
I understand that you want to NAT your Webserver IP to its Public IP when connecting to the on-premise over the S2S VPN. This is not possible to do over the S2S VPN as the S2S VPN will only advertise the Vnets IP range and it will not advertise the Public IP of the Web server to the on-premise VPN device. There is no other way to NAT the IP to its Public IP via the Azure S2S VPN.
In order to achieve this, I would suggest you to use a NVA from the Azure Marketplace and setup a VPN between Azure and on-premise using the same. Using this NVA, you can NAT the outbound traffic from the web server to on-premise.
Another option is to deploy your virtual network with a Public IP address range instead of a private range. As seen from - Creating a Virtual Network document -
Address space: The address space for a virtual network is composed of one or more non-overlapping address ranges that are specified in CIDR notation. The address range you define can be public or private (RFC 1918). Whether you define the address range as public or private, the address range is reachable only from within the virtual network, from interconnected virtual networks, and from any on-premises networks that you have connected to the virtual network. You cannot add the following address ranges:
224. 0.0.0/4 (Multicast)
255. 255.255.255/32 (Broadcast)
127. 0.0.0/8 (Loopback)
169. 254.0.0/16 (Link-local)
168. 63.129.16/32 (Internal DNS, DHCP, and Azure Load Balancer health probe)
With this setup, you will have Public IP addresses for the resources in the VM and when this is presented to your on-premise via VPN, it will be presented with the Public IP addresses itself. This is the only way to have Public IP addresses on both inside and outside of the tunnel i.e., before and after encryption when using the Azure S2S VPN. Hope this helps.
If you require any further assistance, please do let us know and we will be glad to assist. Thank you!
Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Want a reminder to come back and check responses? Here is how to subscribe to a notification.