Install a NM-specific firewalld zone to be used for interfaces that are used for connection sharing. The zone blocks all traffic to the local machine except some protocols (DHCP, DNS and ICMP) and allows all forwarded traffic.
