IPSEC VPN inbound fine, outbound not working

[norgan]

Hi all,
Things are humming pretty well, now time to iron out some wrinkles. I have a site 2 site IPSEC VPN to Azure set up. The Azure machines can get to the LAN on-prem but I can't seem to get back to them.

UPDATE: Guide followed, found one option I was missing. Everything is now in place, the link comes up, and my azure vm can send logs as per the inbound firewall rule.
https://docs.opnsense.org/manual/how-tos/ipsec-s2s-route-azure.html

The route is there, I've double-checked it. but I can't get traffic back to azure. It just routes out to the internet.

not sure what config or log is most useful. Still figuring opnsense out

[norgan]

reserved