What subsystem is responsible if I can connect via s2s VPN connection only in one direction?

I have configured the following s2s VPN (in pfSense) connection which is working in general.

Unfortunately, I can connect (ping, netcat, ssh) only from client to the server, but not back.

If I can ssh normally, it means that firewall is not the problem, right? Since packages are travelling in both directions?

Also I can netcat from server to client by a tunnel address of 192.168.27.2, i.e. run

nc -l 1234

on client, and

nc 192.168.27.2 1234

on server and then I see the communication.

What does it mean? How to diagnose the problem with the means of command line tools?