firewalld can be controlled either from a graphical interface or a command line interface. One must know what zone is active (try firewall-cmd --get-active-zones) to understand what zone is currently in use.  To unset an active service (such as openvpn which is predefined) one could use the command line as root to enter:  firewall-cmd --zone='THE_ZONE_THAT_SHOWED_AS_ACTIVE' --remove-service=openvpn .  This changes the firewall that is currently running only, not the configured setup which is changed by adding --permanent between the firewall-cmd and the --zone=  entries.   Note that current connection states are not affected. A reboot will restore the original (as changed by any firewall-cmd --permanent commands that have run in the session)  Note that the man firewall-cmd page is quite capable but does require a basic understanding of netfilter (iptables).  The graphical interface is more understandable