How can Azure VPN clients reach on-premises through ExpressRoute?

Another possibility is terminating the remote-user VPN on an on-premises firewall and routing the users directly from there. That can be simpler if the firewall already handles remote access, although keeping the VPN in Azure may be preferable when you want the client connection close to the Azure workloads.

You generally do not need Azure Route Server for this. A VPN gateway and ExpressRoute gateway can coexist in the virtual network, allowing Point-to-Site clients to use the existing ExpressRoute path to reach on-premises. The important part is configuring the gateway subnet, address spaces, route propagation, and on-premises return routes correctly.

There are two common designs. The simpler option is to place the VPN gateway alongside the ExpressRoute gateway in the hub VNet, assuming you do not need traffic inspection. If you use a hub-and-spoke design with a firewall or NVA, place the client VPN gateway in the appropriate VNet and use route tables to send the traffic through the firewall and then over ExpressRoute. The second design provides inspection but requires more careful routing.

Route Server is mainly useful when you are exchanging routes dynamically with an NVA. For a straightforward VPN-gateway-to-ExpressRoute setup, user-defined routes and proper return routes on the on-premises side should be sufficient. If there is no need to inspect the traffic with a firewall, adding Route Server would likely add complexity without solving a necessary problem.