http://ronnybull.com/2015/11/20/how-to-centos-7-router/
Enable IP forwarding
Add ZONE= to ifcfg files
sudo firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o em1 -j MASQUERADE -s x.x.x.0/24
sudo firewall-cmd --set-default-zone=internal
sudo firewall-cmd --permanent --zone=external --remove-service=ssh
Add ssh key
Disable root login
Disable password login
Set HandleLidSwitch=ignore in /etc/systemd/logind.conf
sudo systemctl restart systemd-logind