@JeffSchaller and automatically saving iptables rules at shutdown is a terrible idea — you don’t want to save an invalid set of rules that’s locked you out of your own server!

@StephenKitt true! although one of my previous jobs did have that -- save at shutdown and load at startup -- with education among the support team that this was in place, so test your changes and/or have a console window available! Once I got used to it, firewall-cmd's default of "temporary" unless you added --permanent was nice. Also the --timeout option!

@JeffSchaller yup, a timeout is ideal — recover you access in 10 min if you mess up