[northlandboy]

A simple question - why would you configure a rule with both ssh and ssh_version2 in the services column? What's the point? What are you trying to achieve?

As for your understanding of "Match for any", that seems pretty much correct.

My configuration has the standard ssh service configured to match for any, so it doesn't seem unreasonable at all for me that sshv1 would be allowed through by a rule with "any" for service. It's the ssh_version_2 service that is not configured to match for any.

Oh and unless you have an outstanding reason for it, why are you using sshv1 anyway, given that it is known broken?