1Dot this is incorrect. If you try to access SSH using the name of the domain (for example, ssh admin@nysite.com) and you are behind CF this will fail. It's because of the A record entry which CF will mask with one of its own IP addresses instead behind it's proxy.
The nature of TCP is that the connection request waits up to 30 seconds for an ACK response it will never receive, and so it times out as a result.
