Redhat / Centos 7 Firewalld best practice for pptp or L2TP/IPsec rules

Question

Having a quick look at Centos 7, and though I'd spin up a VPN daemon or 3, but immediately discovered the usual packages aren't yet in the core repositories, so had to dig around and found the necessary bits in the likes of the EPEL beta tree. Anyway on to the primary issue, the switch from iptables to firewalld. I know I could revert my play box to iptables and not trouble my betters, but it's a new toy so must play. Started to RTFM and had a quick look and spotted openvpn and ipsec have service definitions, for this new toy, but there is nothing for the likes of pptp, l2tp, NAT-T....so started to spend a few min's creating the likes of a:

/etc/firewalld/services/pptp.xml

<?xml version="1.0" encoding="utf-8"?>
  <service>
    <short>pptp</short>
    <description>Point-to-Point Tunneling Protocol (PPTP)</description>
    <port protocol="tcp" port="1723"/>
  </service>

Or: /etc/firewalld/services/l2tp.xml

<?xml version="1.0" encoding="utf-8"?>
  <service>
    <short>L2TP</short>
    <description>Layer 2 Tunneling Protocol (L2TP)</description>
    <port protocol="udp" port="1701"/>
  </service>

Or: /etc/firewalld/services/nat-t.xml

<?xml version="1.0" encoding="utf-8"?>
  <service>
    <short>NAT-T</short>
    <description>Network Address Translation (NAT-T)</description>
    <port protocol="udp" port="4500"/>
  </service>

etc.....

chmod 640 /etc/firewalld/services/*.xml
restorecon /etc/firewalld/services/*.xml

Then a few rules:

firewall-cmd --zone=external --add-interface=ip_vti0 --permanent
firewall-cmd --zone=external --add-interface=ppp0 --permanent
firewall-cmd --reload
firewall-cmd --get-services

firewall-cmd --zone=external --add-service=l2tp --permanent
firewall-cmd --zone=external --add-service=pptp --permanent
firewall-cmd --zone=external --add-service=nat-t --permanent
....
firewall-cmd --reload

etc.....

But am wondering if I should persist with this approach and get my head around the zones, or simply replicate the standard iptables rules with a firewalld direct rule frig e.g.

iptables -A INPUT -i enp3s0 -p tcp --dport pptp-j ACCEPT
iptables -A INPUT -i enp3s0 -p tcp --dport l2tp -j ACCEPT
iptables -A INPUT -i enp3s0 -p tcp --dport ipsec-nat-t -j ACCEPT
iptables -A INPUT -i enp3s0 -p gre -j ACCEPT
....
iptables -t nat -A POSTROUTING -o enp3s0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.0/28 -o enp3s0 -j MASQUERADE
iptables-save

with:

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -i enp3s0 -p tcp --dport pptp-j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -i enp3s0 -p tcp --dport l2tp -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0T -i enp3s0 -p tcp --dport ipsec-nat-t -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -i enp3s0 -p gre -j ACCEPT
....
firewall-cmd --permanent --direct --add-rule ipv4 filter POSTROUTING 0 -t nat -o enp3s0 -j MASQUERADE 
firewall-cmd --permanent --direct --add-rule ipv4 filter POSTROUTING 0 -t nat -s 192.168.0.0/28 -o enp3s0 -j MASQUERADE -t nat
firewall-cmd --reload

What's the general school of thought (replicate iptables rule sets / do the new service + zone thing), and are there any published / recommended masqueraded and nat'ed rule sets out there on the web.