Configured IPsec site-to-site VPN between azure vnet and on-prem RRAS

Setup:

Configured IPsec site-to-site VPN between azure vnet and on-prem RRAS. I want Azure vm to access internet via on-prem network. Have tried forced tunneling but traffic is being dropped after going through RRAS and network gateway. We are not doing NAT on-prem.

The traffic coming from Azure VM through VPN tunnel would be decrypted at RRAS to private IPs ?which can not be routed to internet without NAT ?

Tried configuring NAT on same RRAS server by setting the demand-dial interface at private and public facing interface as NAT interface but it didnt work....