firewall-cmd --state
so check retval and not text returned. FirewallD conversion to multicall IPTables test