Having the service files is handy, except that not every service that you'll need to run has its own predefined service file. Let's say that you've installed Webmin on your server, which requires port 10000/tcp to be open. A quick grep operation will show that port 10000 isn't in any of our predefined services:

donnie@localhost services]$ pwd
/usr/lib/firewalld/services
[donnie@localhost services]$ grep '10000' *
[donnie@localhost services]$

So, let's just add that port to our default zone, which is still the dmz zone:

donnie@localhost ~]$ sudo firewall-cmd --add-port=10000/tcp
[sudo] password for donnie:
success
[donnie@localhost ~]$

Again, this isn't permanent, because we didn't include the --permanent option. Let's do it again and then reload:

[donnie@localhost ~]$ sudo firewall-cmd --permanent --add-port=10000/tcp
success
[donnie@localhost ~]$ sudo firewall-cmd --reload
success
[donnie@localhost ~]$

You can also add multiple ports at once by enclosing the comma-separated list within a pair of curly brackets, just as we did with the services (yeah, I purposely left the --permanent out):

[donnie@localhost ~]$ sudo firewall-cmd --add-port={636/tcp,637/tcp,638/udp}
success
[donnie@localhost ~]$

And of course, you can remove ports from a zone by substituting --remove-port for --add-port.