with console access feature, it requires the SSH source IP within DigitalOcean IP ranges, the source IP is not customer client IP. if somehow customer want to restrict the Cloud Firewalls inbound rules only with known source IP, console access may timeout.

it will be helpful if you update such info in product doc.

client computer web -- SSH agent in US -- Droplets you want to login