diff --git a/CHANGELOG b/CHANGELOG
index 275dbf3..6a8e9db 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * ospf: precise in the readme file that no daemon is configured/activated
 * logsentry: delete unused default file that we put in /usr/share/scripts
 * base: set the lookup option so that resolv.conf searches /etc/hosts before querying a domain name server; the default is the opposite
+* post-install: add the pf_states check by default in generateldif.sh script
 
 ### Changed
 
diff --git a/roles/post-install/templates/generateldif.sh.j2 b/roles/post-install/templates/generateldif.sh.j2
index fa76eab..6355039 100755
--- a/roles/post-install/templates/generateldif.sh.j2
+++ b/roles/post-install/templates/generateldif.sh.j2
@@ -147,6 +147,13 @@ ServiceName: packetfilter
 ServiceType: firewall
 ServiceVersion: packetfilter
 
+dn: ServiceName=pf_states,EvoComputerName=${EvoComputerName},ou=computer,dc=evolix,dc=net
+NagiosEnabled: TRUE
+objectClass: EvoService
+ServiceName: pf_states
+ServiceType: firewall
+ServiceVersion: pf_states
+
 EOT
 
 if grep -Eq 'sd.*RAID' /var/run/dmesg.boot; then