听群友说是service iptables stop比systemctl disable firewalld的权限更高，当时也确实是stop之后才把防火墙真正给关闭的。
1:查看防火状态
systemctl status firewalld
service iptables status
2:暂时关闭防火墙
systemctl stop firewalld
service iptables stop
3:永久关闭防火墙
systemctl disable firewalld
chkconfig iptables off
4:重启防火墙
systemctl enable firewalld
service iptables restart
5:永久关闭后重启（未测试）
chkconfig iptables on