Tracking down requests denied by firewalld is an important plus to be both strict and precise about what to allow. This small copy-pasta might help you.