There's more...

If you do find yourself on a box that has firewall-cmd installed, but not the iptables userland tool, you might find which package it's in with yum:

$ yum whatprovides iptables

In this case, iptables is the package you want to install, if you're something of a purist.