add a rule to permanently block an ipv4 address with firewalld
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="x.x.x.x/xx" reject'
this will give you a list of permanently banned ips
firewall-cmd --list-rich-rules --permanen
See here for more info
https://fedoraproject.org/wiki/Features/FirewalldRichLanguage