firewall-cmd --list-all

firewall-cmd --get-services
ls /usr/lib/firewalld/services

firewall-cmd --add-service smtp

firewall-cmd --add-service smtp --permanent
firewall-cmd --reload

firewall-cmd --add-port=123/udp

man firewalld.richlanguage
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.2.3" reject type="icmp-admin-prohibited"' --permanent
firewall-cmd --reload

firewall-cmd --remove-service=ssh