Having a quick look at Centos 7, and though I'd spin up a VPN daemon or 3, but immediately discovered the usual packages aren't yet in the core repositories, so had to dig around and found the necessary bits in the likes of the EPEL beta tree. Anyway on to the primary issue, the switch from iptables to firewalld. I know I could revert my play box to iptables and not trouble my betters, but it's a new toy so must play. Started to RTFM and  had a quick look and spotted openvpn and ipsec have service definitions, for this new toy, but there is nothing for the likes of pptp, l2tp, NAT-T....so started to spend a few min's creating the likes of a:/etc/firewalld/services/pptp.xml<?xml version=1.0 encoding=utf-8?>  <service>    <short>pptp</short>    <description>Point-to-Point Tunneling Protocol (PPTP)</description>    <port protocol=tcp port=1723/>  </service>Or: /etc/firewalld/services/l2tp.xml<?xml version=1.0 encoding=utf-8?>  <service>    <short>L2TP</short>    <description>Layer 2 Tunneling Protocol (L2TP)</description>    <port protocol=udp port=1701/>  </service>Or: /etc/firewalld/services/nat-t.xml<?xml version=1.0 encoding=utf-8?>  <service>    <short>NAT-T</short>    <description>Network Address Translation (NAT-T)</description>    <port protocol=udp port=4500/>  </service>etc.....chmod 640 /etc/firewalld/services/*.xmlrestorecon /etc/firewalld/services/*.xmlThen a few rules: firewall-cmd --zone=external --add-interface=ip_vti0 --permanentfirewall-cmd --zone=external --add-interface=ppp0 --permanentfirewall-cmd --reloadfirewall-cmd --get-servicesfirewall-cmd --zone=external --add-service=l2tp --permanentfirewall-cmd --zone=external --add-service=pptp --permanentfirewall-cmd --zone=external --add-service=nat-t --permanent....firewall-cmd --reloadetc.....But am wondering if I should persist with this approach and get my head around the zones, or simply replicate the standard iptables rules with a firewalld direct rule frig e.g.iptables -A INPUT -i enp3s0 -p tcp --dport pptp-j ACCEPTiptables -A INPUT -i enp3s0 -p tcp --dport l2tp -j ACCEPTiptables -A INPUT -i enp3s0 -p tcp --dport ipsec-nat-t -j ACCEPTiptables -A INPUT -i enp3s0 -p gre -j ACCEPT....iptables -t nat -A POSTROUTING -o enp3s0 -j MASQUERADEiptables -t nat -A POSTROUTING -s 192.168.0.0/28 -o enp3s0 -j MASQUERADEiptables-savewith:firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -i enp3s0 -p tcp --dport pptp-j ACCEPTfirewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -i enp3s0 -p tcp --dport l2tp -j ACCEPTfirewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0T -i enp3s0 -p tcp --dport ipsec-nat-t -j ACCEPTfirewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -i enp3s0 -p gre -j ACCEPT....firewall-cmd --permanent --direct --add-rule ipv4 filter POSTROUTING 0 -t nat -o enp3s0 -j MASQUERADE firewall-cmd --permanent --direct --add-rule ipv4 filter POSTROUTING 0 -t nat -s 192.168.0.0/28 -o enp3s0 -j MASQUERADE -t natfirewall-cmd --reloadWhat's the general school of thought (replicate iptables rule sets / do the new service + zone thing), and are there any published / recommended masqueraded and nat'ed rule sets out there on the web. 
Redhat / Centos 7 Firewalld best practice for pptp or L2TP/IPsec rules
centos;iptables;vpn;firewalld;pptp