The zone configuration of public

public.xml

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <interface name="eth0"/>
  <service name="dhcpv6-client"/>
  <service name="mosh"/>
</zone>

After setting up the service of knockd, remove ssh from the zone of public:

foo@bar:~$ sudo firewall-cmd --permanent --zone=public --remove-service=ssh && sudo firewall-cmd --reload