Don't restrict external traffic to ssh.

This rule doesn't look like any of the other rules since there's no "in" or "out". Is that superfluous?

Do we want to support protocols other than tcp? I wonder if we want to leave out the protocol specifier, too? Something like

  'pass inet6 to %s:network' % name