add rule inet filter input tcp dport { 22, 2222 } accept comment "SSH"
add rule inet filter input udp dport 41641 accept comment "Tailscale"