Remote browsing using site-to-site IPsec VPN

You are right, the recipe as given will only work under very special circumstances.

What is missing is the default route (0.0.0.0/0) on the remote FGT pointing to the tunnel interface.

The author describes to set up a static route to the HQ public IP address as a host route (172.20.120.154/32) but makes his first mistake to make the network mask too large (as /24). This will not prevent the tunnel from coming up but will make a lot of hosts on the internet inaccessible. As a host route (/32), this route will enable the remote FGT to reach the HQ FGT to establish the tunnel.

When the tunnel is up, traffic will only traverse the tunnel via the 'HQ private LAN' route to destinations on the HQ private LAN. To reach the internet across the tunnel, you need a default route on the remote FGT pointing to the tunnel interface - and this is missing.

It's distance doesn't really matter actually - if the tunnel is down, the explicit host route suffices to enable contact to the HQ FGT. And once the tunnel is up, a default route with any distance will do.

Frankly, I don't understand that Keith Leroux hasn't edited the recipe - users have pointed out the mistakes months ago. I hope he (or someone from Docs dept.) will read this.