tcp_services = "{ domain, ntp, http, https, ssh, 222 }"
udp_services = "{ domain, ntp }"
ext_if = "em0"
vpn_if = "wg0"

block all
set skip on lo
pass out inet proto icmp from any to any # ping
pass proto tcp from any to any port $tcp_services
pass proto udp from any to any port $udp_services

pass in proto tcp from any to any port 222

block user transmission
pass out route-to ($vpn_if "10.2.0.1") user transmission