VPC Peering + VPN Tunnel

I am trying to realize the following setup on GCP for my Atlas cluster:

Connecting to the cluster from any VM within the Cloud VPC works perfectly. However, connecting from my on-site network using the private endpoint (e.g. suffix “-pri”) does not work. I have configured all the required routing and dns settings, and I do see packets leaving the on-prem end of the IPSec tunnel. ICMP to any of the shards does not work either.

Does anyone have experience with such a setup and is able to comment on what I’m doing wrong? My guess is that the packets are either not forwarded to the peering network, or they are lost on the way back from the cluster. Since I am not able to inspect the gcp project created by atlas, it’s hard to debug this any further.

Thanks a lot in advance.