The problem is that 4OD tries to use RTMPE over port 1935, and if it gets a reject back from a firewall attempts to tunnel the traffic over HTTP.
CLEO blackholes traffic on iffy ports, which is a sensible policy. This means however that 4OD never gets it's reject packet (the difference between DROP and REJECT in iptables parlance) and thus never gets around to trying HTTP. It instead just assumes that there isn't a connection, this is really a flaw in 4OD in my opinion.
So what's the solution? if you have a local firewall in your control, (i.e. sat before your CLEO edge router), configure it to reject traffic on port 1935. You could even try a 'personal' firewall on the clients being used.
WARNING!! This is really just a best guess, and I can't try this for myself... If any one does get around to giving this a shot let us know if it works!