Internet access through IPSec

Hello! Thank you for contacting us.
We are working on an answer for you.

Hi EuricoD,
You can add the network segment for the branch to access the network to the ACL of the headquarters,
and direct the route to the headquarters at the branch.

Good answer

You could configure a DSVPN among them and implement a routing protocol like OSPF. Then, you could originate a default route just in the site where you intend to have the traffic being sent to the internet (all other sites will learn that this site is the default to reach any other address).

Check this example:

https://support.huawei.com/hedex/pages/EDOC1100203017AEK07051/02/EDOC1100203017AEK07051/02/resources/dc/dc_ar_cfg_vpn_045539.html?ft=0&fe=10&hib=8.3.6.3.2&id=EN-US_TASK_0176365505&text=Example%20for%20Configuring%20DSVPN%20to%20Allow%20Branches%20to%20Learn%20Only%20Summarized%20Routes%20to%20the%20Headquarters%20and%20Implement%20Communication%20Between%20the%20Branches%20(Applicable%20When%20There%20Are%20a%20Large%20Number%20of%20Branches)&docid=EDOC1100203017

Do you know how to generate a default route on OSPF? You just got do it in HQ in this example. In this example, he uses the RIP as the routing protocol interconnecting the sites, but you can use the OSPF.