firewalld port still open after removing port and services

I have created a script to install and configured firewalld on Centos 7. Most of the rules have worked correctly, but the SSH port still shows as Open when running a nmap scan. I know this is not a big deal and that changing ports is just security by obscurity but would like to know why. firewall-cmd --zone=dmz --add-masquerade --permanent firewall-cmd --zone=dmz --add-interface=eth0 firewall-cmd --zone=internal --add-port=${MONGO}/tcp --permanent firewall-cmd --zone=internal --add-port=${CHAT}/tcp --permanent firewall-cmd --zone=internal --add-port=${NFS_CLIENT}/tcp --permanent firewall-cmd --zone=internal --add-port=${NODE_EX}/tcp --permanent firewall-cmd --zone=dmz --add-forward- port=port=${22}:proto=tcp:toport=${22123} --permanent firewall-cmd --zone=dmz --add-port=${RSSH}/tcp --permanent --permanent Starting Nmap 7.40 ( https://nmap.org ) at 2017-10-04 17:33 BST Nmap scan report for Host is up (0.45s latency). Not shown: 997 filtered ports PORT STATE SERVICE 22/tcp open ssh 8083/tcp open us-srv 8086/tcp closed d-s-n sudo firewall-cmd --list-all dmz (active) target: default icmp-block-inversion: no interfaces: eth0 eth1 sources: services: ports: 22123/tcp 8086/tcp 8083/tcp protocols: masquerade: yes forward-ports: port=22:proto=tcp:toport=22123:toaddr= source-ports: icmp-blocks: rich rules: All ideas welcome. Thanks