Problem with Spoke > Hub > on-prem access

I am a little bit lost - maybe there is something in Azure that I do miss. I have a hub/spoke in Azure with on-prem connected via Azure Network Gateway and Site-2-Site tunnel: hub is 172.30.50.0/...