actually... you do not need to set up anything within STEP 7.
What you need to do is changing the settings for your Windows PC.
In the Network settings you will have to use the IP of your local SCALANC S as Default Gateway... and then STEP7 tries to establish the online connection over this module.

Well, if you want to have additional internet Access you may have to use default routes... but first of all I would try it with the default Gateway setting in the Network settings.

Best regards

I would say... the solution 2 mentioned by you would certainly work because if the SCALANCE S works as Firewall you are in the same network as the destination network, so the VPN Gateway has no problem... as long as you allow the IP’s of the foreign network.
An alternative solution is a setting (if possible) in the plant VPN Gateway Router. There you have to add a Router with its network located locally. In such a case the VPN Client needs to know that there are two networks it can reach with this VPN and the Gateway knows where the second network is... so this would work too... but you would need a VPN Gateway that supports this feature.

Best regards