I found when my centos firewalld in started status, the entrance direction IP access in high frequency, the IP will be block by firewalld.
but in the official site, I don't find where is the place state of the function.
I think there should have the official notes, and in firewalld I could see where is the IPs it blocked.