firewall-cmd --zone=public --add-interface=<internet interface> --permanent
firewall-cmd --zone=internal --add-interface=<intranet interface as gateway> --permanent
firewall-cmd --set-default-zone=public --permanent
firewall-cmd --reload
firewall-cmd --get-default-zone
firewall-cmd --new-policy internal-public --permanent
firewall-cmd --reload
firewall-cmd --policy internal-public --add-ingress-zone=internal --permanent
firewall-cmd --policy internal-public --add-egress-zone=public --permanent
firewall-cmd --policy internal-public --set-target=ACCEPT --permanent
firewall-cmd --reload
firewall-cmd --info-policy internal-public