An XCCDF Group - A logical subset of the XCCDF Benchmark
netwk
mask
ip_protocol
firewall-cmd --permanent --add-rich-rule='rule family="ip_protocol" source address="netwk/mask" service name="ssh" accept'