>you block port 22 and use iptables to redirect a random high port to port 22, you'll never see any connection attempts
This is a really bad idea, stick to lowports. Despite SSH doing host authentication, you really don't want non-root users being able to hijack the sshd port.
If they are using iptables to do the redirect instead of changing sshds port, wouldn't an attacker need a way to change/disable iptables, which also requires root? There shouldn't be a way for an application to put itself in front of iptables.
Ah! You're right, I didn't think that through. iptables is indeed a safe way to do this, however changing your port in the configs to a highport isn't.
This is a really bad idea, stick to lowports. Despite SSH doing host authentication, you really don't want non-root users being able to hijack the sshd port.