As default SSH and dhcpv6-client is allowed,
as in my unterstanding the default config on a "Desktop firewall" should allow
no incoming connections.

I guess to avoid locking one self out on headless installations (aka no SSH )
firewalld systemd service should be disabled by default on installation.

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these template lines ***