Comment by SpaceInvader

Ok, found: pass in on egress proto tcp to any port ssh

It means that you need to open port 22 (ssh) in order to be able to log in as recommended firewall setting is to 'deny all' by default.