Assign conntrack helper without allowing INPUT for service

Hi,

I'm trying to use # firewall-cmd --set-automatic-helpers=no to have it to only assign the expected helpers, as it is more secure.

The protocol I'm interested is FTP. The gateway in question doesn't provide any FTP service, but at the same time, it seems I cannot get firewalld to add the CT iptables rule if I don't add the FTP service to the zone ('internal' one, fwiw), which in turn also allows INPUT of such packets but that's not wanted.

Is there a way that I can allow it to assign the helper, without having to allow the INPUT for such service?

I'm on firewalld-0.4.4.4-6.el7.noarch, on CentOS.

Thanks, Marcelo