[CentOS] CentOS 7, systemd and firewall-cmd

I'm having issues with an rsyncd. systemctl status rsyncd shows it running
rsyncd.service - fast remote file copy program daemon
   Loaded: loaded (/usr/lib/systemd/system/rsyncd.service; enabled)
   Active: active (running) since Wed 2015-02-25 10:57:02 EST; 4h 43min ago
 Main PID: 31672 (rsync)
   CGroup: /system.slice/rsyncd.service
           `-31672 /usr/bin/rsync --daemon --no-detach

But
firewall-cmd --list-all
public (default, active)
  interfaces: em1 em2
  sources:
  services: dhcpv6-client mountd nfs rpc-bind samba ssh
  ports: 631/udp 22/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

And yet if I do iptables-save, it shows 873 open.

a) which should I believe, firewall-cmd or iptables-save?
b) why does firewall-cmd not show 837 open?
c) I've been googling, and know that I can tell firewall-cmd to open the
port,
     but if there's a "correct" way, presumably one that will show rsyncd on
     the services line, I'd like to do it that way.

Clues?

       mark