vyos@VyOS# set firewall name outgoing_traffic_tun0 default-action drop
vyos@VyOS# set firewall name outgoing_traffic_tun0 enable-default-log

vyos@VyOS# set firewall name outgoing_traffic_tun0 rule 10 description allow_192.168.2.0_to_192.168.1.0
vyos@VyOS# set firewall name outgoing_traffic_tun0 rule 10 action accept
vyos@VyOS# set firewall name outgoing_traffic_tun0 rule 10 source address 192.168.2.0/24
vyos@VyOS# set firewall name outgoing_traffic_tun0 rule 10 destination address 192.168.1.0/24

vyos@VyOS# set interfaces tunnel tun0 firewall out name outgoing_traffic_tun0