ok changed to firewallcmd-new - the stateful iptables entry has a -new suffix as well so keeping this consistent.

Once the naming is right I'm tempted to add a firewallcmd that doesn't have state NEW.

Is it worth adding a jail.conf entry for it in 0.8?