pf and Wireguard

...

Change:

match out on egress from (wg0:network) to any nat-to (egress:0)

To:
match on egress from (wg0:network) to any nat-to (egress:0) tag "wireguard"

pass tagged "wireguard" keep state

--
-Luke