Various VPNs use the esp, gre protocols, also remember isakmp (udp port 500 for key exchange)
pass quick inet proto esp pass quick inet proto udp to port isakmp ## udp port 500 for key exchange pass quick proto gre
Note: Your context may require more restrictive criteria