Ok, found: pass in on egress proto tcp to any port ssh

It means that you need to open port 22 (ssh) in order to be able to log in as recommended firewall setting is to 'deny all' by default.

Thanks. That's weird, because I can already log in with ssh on port 22. I was asking because I didn't realize how it was related to a mail server. Now I understand you might want to log in remotely.