How to wrap Internet traffic through a remote branch using WatchGuard XTM2 and BOVPN?

Question

Computer networks

Scheme (attached) - 5 peripheral subnets (offices) connected to the central one using BOVPN tunnels.
WatchGuard XTM2 firewalls are used everywhere.
The problem is that the Internet is not served at the main point, but is located on the periphery.
The main task is to organize access to the Internet from all connection points through the existing peripheral.
I easily implemented such a task on Mikrotik equipment, by marking traffic (mangle routing mark) at a point deprived of the Internet, and creating a route through the tunnel based on this marking. At the point where the Internet was present, it translated addresses from a remote gray network towards the Internet.
In the context of technologies based on WatchGuard XTM equipment, I look towards Route for All Internet-Bound Traffic goo.gl/JGKk3D . But I'm afraid that this can break connections with information resources located on the central connection point.
I am also starting to consider the option with an HTTP proxy server on a connection point with Internet access and distributing Proxy settings through group policies.
I ask you to express your ways of solving this problem, if they, of course, exist.

Answer 1

I am not a supporter of using proprietary vendor-dependent technologies, especially in fairly simple networks. I can’t say anything about XTM, but on typical equipment such as ciscos and microtics, you can think of a lot of things:
1) PBR on a piece of iron with Internet access
2) throw the Internet to the center using another, separate tunnel, at least on VRFs, at least on L2TP
3 ) just on a piece of iron connected to an Internet, make an Internet in one VRF, Vpn - in another, submit it all to a central point
. If there are a sufficient number of white addresses when connecting to an Internet, nat would still do it at a central point. More logical somehow...