how do I allow a service on an arbitrary local interface the firewalld way?

[Matthew Miller]

I'm making a crude fake EC2 environment on my test machine, and as part of
that, I need a web server listening on 169.254.169.254. I've bound this
address to lo:0. How do I use firewall-cmd to allow http through? It's
blocked by default. 

I thought I could do it with the interface=lo:0 argument, but that gives me
"Warning: ALREADY_ENABLED". And firewall-cmd --list-interfaces returns only
'wlan0'

There doesn't appear to be any real documentation for firewall-cmd. The web
page is just development plans, the help is a maze of BNF, and the man page
is full of less-than-helpful stuff like:

       interface=<interface>
              Use an interface name.


Where should I look to find out more?


-- 
Matthew Miller  ☁☁☁  Fedora Cloud Architect  ☁☁☁  <mattdm at fedoraproject.org>