firewall-cmd --list-all

firewall-cmd --zone=public --add-port=12345/tcp --permanent

firewall-cmd --zone=public --remove-port=12345/tcp --permanent

firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="192.168.1.10" port port=22 protocol=tcp reject'

firewall-cmd --reload

参考：

https://linux.cn/article-8098-1.html