After some general good practice w/firewalld, as I have a set up which feels like it might a bit of a kludge.
Public zone - has interface assigned, set to 'drop'.
Internal zone - initially set up one service only, SSH, coming from a single source 192.168.1.2/32 IP. (I know it's a class C, just to illustrate diff IPs)
Rich rules: ipv4, source 192.168.10.2/32 SMTP, SMTPS and port 587/tcp (as submission service appears to not be installed by default with firewalld) all set to accept.
192.168.1.2 can SSH fine. 192.168.10.2 could not connect on port 25.
So I then deleted all those rich rules and set a new source in the internal zone of 192.168.10.2, and added in SMTP, SMTPS and port 587.
This worked - however, 192.168.10.2 could also SSH, which wasn't required. Instead I put in an explicit rich rule to deny 192.168.10.2 over SSH.
This got me to where I wanted to go, but is it a slightly clunky way of doing it? Could anyone shed any light on why the rich rules weren't working properly?