I've got to be doing something stupid.  I run the installer (0.9.2) and do the reboot at the end. as suggested.  When the server comes back up I am no longer able to ssh in.  Should I not take the default iredmail firewall rules?

I took the defaults in the below section:
  [ INFO ] Disable SELinux in /etc/selinux/config.
  < Question > Would you like to use firewall rules provided by iRedMail?
  < Question > File: /etc/firewalld/zones/iredmail.xml, with SSHD port: 22. [Y|n]
  [ INFO ] Copy firewall sample rules: /etc/firewalld/zones/iredmail.xml.
  < Question > Restart firewall now (with SSHD port 22)? [y|N]

The first time I ran it I answered "y" to that last "Restart" question and then I got locked out on reboot.  I figured I'd not been careful so I reloaded the server (CentOS 7, minimal) and did it again.  The second time I answered "no" but I am locked out again on the second try.

It does say "with SSHD port 22", am I misreading it?

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.2
- Linux/BSD distribution name and version: CentOS 7
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Web server (Apache or Nginx):Apache
- Manage mail accounts with iRedAdmin-Pro?no
- Related log if you're reporting an issue:
====

*** Update ***
I managed to get in and find that iptables has this kind of rule sets:
[root@neuron /]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere           
INPUT_direct  all  --  anywhere             anywhere           
INPUT_ZONES_SOURCE  all  --  anywhere             anywhere           
INPUT_ZONES  all  --  anywhere             anywhere           
ACCEPT     icmp --  anywhere             anywhere           
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere           
FORWARD_direct  all  --  anywhere             anywhere           
FORWARD_IN_ZONES_SOURCE  all  --  anywhere             anywhere           
FORWARD_IN_ZONES  all  --  anywhere             anywhere           
FORWARD_OUT_ZONES_SOURCE  all  --  anywhere             anywhere           
FORWARD_OUT_ZONES  all  --  anywhere             anywhere           
ACCEPT     icmp --  anywhere             anywhere           
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
OUTPUT_direct  all  --  anywhere             anywhere           

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_direct (1 references)
target     prot opt source               destination         

Chain INPUT_ZONES (1 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain INPUT_direct (1 references)
target     prot opt source               destination         

Chain OUTPUT_direct (1 references)
target     prot opt source               destination

I am allowed back in if I do an "iptables --flush".  Prior to that there is no connectivity.