The rule set to block all outgoing connections except for VPN access could be like this:
block drop all pass on lo0 pass on utun0 pass out proto udp from any to xxx.yyy.zzz.ttt port pppp
This works fine. However, I “forgot” that I still want to have access to the LAN as well. I thought then I could simply add these rules “somewhere”, but I don't know really where… I know the order is important though.
pass in on en4 from 192.168.0.0/24 to any pass out on en4 from any to 192.168.0.0/24
No success… I’m pretty sure I’ve got something right, but I don’t know the exact layout.