[root@host]# cat init.sls
# CentOS7 FirewallD firewall
firewalld:
  enabled: True
  default_zone: public
  zones:
    public:
      short: Public
      description: "test"
      services:
        - http
        - https
        - ssh
        - salt-minion
{% if grains['id'] == 'host.loc' %}
      rich_rules:
        - family: ipv4
          source:
              address: 9.9.9.9/24
          port:
              portid: 999
              protocol: tcp
          accept: true
        - family: ipv4
          source:
              address: 8.8.8.8/24
          port:
              portid: 888
              protocol: tcp
          accept: true
{% endif %}