Independent of the firewall vendor, you will need an additional policy to allow traffic from the tunnel end to your WAN port (destination address 'all'). Here, you have to apply source NAT as private addresses like those used on the branch network are not routed over the internet. In a stateful firewall, reply traffic will be automatically allowed to flow from WAN port to the tunnel and eventually to the branch LAN.
As you have already stated on the branch router/firewall you need an additional default route pointing to the (private) address of the HQ firewall. The associated policy should allow 'all' as destinations, not only the private address range of the HQ, as it might do at the moment.
On the branch firewall, you need an additional (host) route to the public address of the HQ firewall. Otherwise, this address cannot be reached when the tunnel is down. For example, add "220.127.116.11/32" via WAN port.
If you already have a default route in place (pointing to WAN port) then either delete it or make sure it has a higher distance than the new default route to the tunnel.