AD Syncrhronization via site-to-site vpn

"I was of the opinion that all traffic flows free via VPN."

You have to specify what is allowed.

The automatically created rule allows everything. But still: only traffic from branch to headoffice is routed, not vice versa

will check agan however

I assume the Branch to HQ rules were added automatically. Create the same rule for HQ to Branch where the source and destination zones / network are reversed for the oppositie direction.

I assume the Branch to HQ rules were added automatically. Create the same rule for HQ to Branch where the source and destination zones / network are reversed for the oppositie direction.