As we've seen, any time we do anything with the normal firewall-cmd commands on RHEL/CentOS 7, firewalld automatically translates those commands into iptables rules and inserts them into the proper place (or, it deletes the rules, if you've issued some sort of delete command). However, there are some things that we can't do with the normal firewalld-cmd commands. For example, we can't use normal firewall-cmd commands to place rules in a specific iptables chain or table. To do things like that, we need to use the direct configuration commands.
The firewalld.direct man page and the documentation at the Red Hat site both warn you to only use direct configuration as an absolute last resort when ...
