How to open ssh in firewalld only for a trusted subnet?

Question

firewall

I am slowly mastering the new CentOs line - after the six, some things seem unusual. I had a question about configuring firewalld: how to open ssh in it only for a trusted network?
It is assumed:
1. There is a server with centos7 (there is no graphical interface and will not be)
2. There is only one network card
3. There are several subnets that are considered trusted and for which you need to allow access via ssh, and deny all other addresses
4. On the server enabled fail2ban (trusted networks are trusted, and fail2ban never hurts)
5. firewalld enabled with default rules

Answer 1

hosts.deny, hosts.allow - not?