Your custom SSH firewall rule doesn't allow traffic from Google services. SSH connections from the Google Cloud console are refused if custom firewall rules do not allow connections from IAP or Google's IP address range.
To resolve this issue, do one of the following:
If you use Identity-Aware Proxy (IAP) for TCP forwarding, update your custom firewall rule to accept traffic from IAP, then check your IAM permissions.
Update your custom firewall rule to allow traffic from 35.235.240.0/20, the IP address range that IAP uses for TCP forwarding. For more information, see Create a firewall rule.
Grant permissions to use IAP TCP forwarding, if you haven't already done so.
If you don't use IAP update your custom firewall rule to allow traffic from Google's entire IP range.
- Update your custom firewall rule to allow traffic from Google IP addresses. For more information, see Updating firewall rules.
As @Kolban suggested you can check this documentation for troubleshooting SSH for additional information.