Problems betwwen pf in FreeBSD 13 and WireGuard

Hi all,

I have a problem between pf rules and WireGuard connections that I can't 
understand. First my pf rules:

prodif          = "vtnet0"
pubif           = "vtnet1"
mgmtif          = "vtnet2"
ctfif           = "vtnet3"
dmzif           = "vtnet4"
wgif            = "wg0"
int_ifs         = "{" $prodif $mgmtif $ctfif $dmzif $wgif "}"

set skip on { lo wg0 }
set block-policy drop
set state-policy if-bound
set loginterface egress
set timeout { tcp.established 7200, tcp.closing 60 }


# Scrubbing rules
scrub in all random-id fragment reassemble no-df max-mss 1440

nat on egress from <internal_networks> to !<internal_networks> -> (egress:0)
no nat
no rdr


# Spoofing protection for all network interfaces.
block in log from no-route label "Deny non-routeable traffic rule"
block in log quick from urpf-failed label "Deny failed uRPF check rule"

# Default blocking all traffic in on all network interfaces
block return in log on $int_ifs label "Deny incmoming traffic on $if"

# Deny all rest of packets with logging
block log all

# Allow ICMP requests to check default route
pass out on egress inet proto icmp from (self) icmp-type echoreq label 
"Allow ICMP requests for public interface"

...........................................................

pass in quick on $wgif inet proto { tcp udp icmp } from <wg_admins> to 
any label "Allow access to $dstaddr from $srcaddr"

pass out on $prodif

With these rules, I can access to FreeBSD via ssh, but I can not access 
to any other host in the network. Connections always are dropped by rule 
"block log all" ... and I don`´t understand why ...

May be a bug? Or do I need to enable some option in WireGuard side?



-- 
Best regards,
C. L. Martinez