By "firewall" I am assuming you mean "firewalld" introduced along with the transition to systemd. It is important to know that not all zones are active and the way you activate them is when you assign a network asset to them, like a port or IP address or a service to a particular zone. Zones themselves have various default settings in terms of what traffic they allow or stop, some would drop all traffic, some by default turn masquerading on, some allow any and all traffic, would have only ssh allowed through etc.
firewall-cmd is the command you'd use to interact with firewalld, no changes will take effect right after you issued the command and none are permanent/survive reboot by default. You will have to use options to firewall-cmd to apply changes to the current setup and make them survive reboot. So know the followwing sequence of commands to make your changes to firewall last:
firewall-cmd --permanent [--some-options-here] //to make your command survive reboot use --permanent
firewall-cmd --reload //to make your changes take effect immediately for the current setup.
If you already know iptables syntax, your knowledge is applicable with firewalld as well, in the form of direct rules that will take precedence over any rich rules you already set with firewalld.
RHEL 7's product documentation concerning network administriation will help you go deeper into the subject and of course man pages on firewalld, firewall-cmd and firewalld.richlanguage. Practical application of firewalld shouldn't be that much different from what is described in documentation.
