Reject all except for whitelist policy with firewalld

I've been reading on firewalld for about the whole morning, and I came up with the following public zone:

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <source address="167.114.37.0/24"/>
  <source address="92.222.185.0/24"/>
  <source address="92.222.184.0/24"/>
  <source address="92.222.186.0/24"/>
  <source address="149.202.34.10/32"/>
  <service name="dhcpv6-client"/>
  <service name="http"/>
  <service name="ssh"/>
  <service name="https"/>
</zone>

The best I could figure is that this zone should only allow incoming connections on those ports/services, and provide full access to those subnets. However, when I scan my server with nmap, I get boatloads of open ports (and I am most definitely not in one of the whitelisted subnets).

PORT      STATE    SERVICE
1/tcp     open     tcpmux
3/tcp     open     compressnet
4/tcp     open     unknown
6/tcp     open     unknown
7/tcp     open     echo
9/tcp     open     discard
13/tcp    open     daytime
17/tcp    open     qotd
19/tcp    open     chargen
20/tcp    open     ftp-data
21/tcp    open     ftp
22/tcp    open     ssh
23/tcp    open     telnet
24/tcp    open     priv-mail
25/tcp    filtered smtp
26/tcp    open     rsftp
30/tcp    open     unknown
32/tcp    open     unknown
33/tcp    open     dsp
37/tcp    open     time
42/tcp    open     nameserver
43/tcp    open     whois
49/tcp    open     tacacs
53/tcp    open     domain
70/tcp    open     gopher
79/tcp    open     finger
80/tcp    closed   http
81/tcp    open     hosts2-ns
82/tcp    open     xfer
83/tcp    open     mit-ml-dev
84/tcp    open     ctf
85/tcp    open     mit-ml-dev
88/tcp    open     kerberos-sec
89/tcp    open     su-mit-tg
90/tcp    open     dnsix
99/tcp    open     metagram
100/tcp   open     newacct
106/tcp   open     pop3pw
109/tcp   open     pop2
110/tcp   open     pop3
111/tcp   open     rpcbind
113/tcp   open     ident
119/tcp   open     nntp
125/tcp   open     locus-map
135/tcp   filtered msrpc
139/tcp   filtered netbios-ssn

... the list goes on, I thought I'd stop there. What am I missing here?

EDIT If I try to access one of those open or filtered ports, say with curl, I get the following

$ curl myserver.example.com:125
curl: (7) Failed to connect to myserver.example.com port 125: Operation timed out

while I correctly get connection refused when I try to access one of the closed ports.