I have two machines hooked up to a router, one Windows with PuTTY, and one CentOS 6.4 with sshd and with the default SELinux still enabled.  They can both ping each other successfully.I installed the policycore-python package so I could use semanage, then followed these directions.Step 4 looked like it's the new default, since it was already set up that way.Step 5 worked and I assume the stuff about ~/.ssh/config is for setting up your ssh client on another machine, so it doesn't apply (I can do something similar in PuTTY.)Step 6 I figured the shortest and most applicable thing was the third option, so I ran:iptables -A INPUT -p tcp --dport 2345 --syn -m limit --limit 1/m --limit-burst 3 -j ACCEPTiptables -A INPUT -p tcp --dport 2345 --syn -j DROPservice iptables saveservice iptables restartAt this point, I can do ssh -p 2345 localhost and also ssh -p 2345 192.168.1.4 on the CentOS box and log into itself fine, but I can no longer PuTTY into the CentOS box.  I put the right IP and port 2345 in the connection window, but upon attempting to connect, I get a black screen with a solid green cursor, which, after a few seconds, gives a GUI popup saying Network error: Connection timed out.If I stop the iptables service, I can log in using PuTTY the same way.  So it seems the problem is definitely with iptables and not sshd (nor semanage?).  What's wrong with my iptables?$ sudo iptables -LChain INPUT (policy ACCEPT)target     prot opt source               destinationACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHEDACCEPT     icmp --  anywhere             anywhereACCEPT     all  --  anywhere             anywhereACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:sshREJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibitedACCEPT     tcp  --  anywhere             anywhere            tcp dpt:2345 flags:FIN,SYN,RST,ACK/SYN limit: avg 1/min burst 3DROP       tcp  --  anywhere             anywhere            tcp dpt:2345 flags:FIN,SYN,RST,ACK/SYNChain FORWARD (policy ACCEPT)target     prot opt source               destinationREJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT)target     prot opt source               destination
iptables prevents connection via ssh after port change despite ACCEPT rule
ssh;centos;putty;sshd;timeout
The REJECT rule has to come after the new rules.  Do this:$ sudo service iptables stop[sudo] password for kev:iptables: Flushing firewall rules:                         [  OK  ]iptables: Setting chains to policy ACCEPT: filter          [  OK  ]iptables: Unloading modules:                               [  OK  ]$ sudo nano /etc/sysconfig/iptables$ sudo service iptables startWhen nano opens, cut the REJECT line and uncut it below the two new rules, then writeout and quit.Also, you'll need to ssh from localhost just once before you can do it from the outside.