$ firewall-cmd --zone=trusted --add-port=80/tcp

$ iptables -L -n | grep 80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 ctstate NEW

$ firewall-cmd --zone=trusted --remove-port 80/tcp
success
$ firewall-cmd --zone=trusted --remove-port 80/tcp
Warning: NOT_ENABLED: '80:tcp' not in 'trusted'
success

firewall-cmd --zone=trusted --add-rich-rule='rule family="ipv4" port port="80" protocol="tcp" reject'

firewall-cmd --zone=trusted --add-rich-rule='rule family="ipv4" source NOT address="192.168.122.1" port port="80" protocol="tcp" reject'firewall-cmd --zone=trusted --add-rich-rule='rule family="ipv4" source NOT address="192.168.122.1" port port="80" protocol="tcp" reject'

firewall-cmd --zone=trusted --add-rich-rule='rule family="ipv4" source NOT address="192.168.122.1" port port="80" protocol="tcp" reject'firewall-cmd --zone=trusted --add-rich-rule='rule family="ipv4" source NOT address="192.168.122.0/24" port port="80" protocol="tcp" reject'