By default, the firewall configuration works on the in-memory running state. With the firewall-cmd command-line too, add --permanent to change to configuring the permanent config (you'll need to do one of both to make the change right away _and_ across reboots).