diff --git a/CHANGELOG.md b/CHANGELOG.md
index f545fd9b..d7267eae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ The **patch** part changes incrementally at each release.
 * evolinux-base: fail2ban is not enabled by default
 * evolinux-users: refactoring of the SSH configuration
 * mysql-oracle: copy evolinux config files in mysql.cond.d
+* generate-ldif: add a minifirewall service when /etc/default/minifirewall exists
 
 ### Fixed
 
diff --git a/generate-ldif/templates/generateldif.sh.j2 b/generate-ldif/templates/generateldif.sh.j2
index 0b45bc1c..f0cdd233 100755
--- a/generate-ldif/templates/generateldif.sh.j2
+++ b/generate-ldif/templates/generateldif.sh.j2
@@ -200,6 +200,19 @@ ServiceType: monitoring
 EOT
 fi
 
+# minifirewall
+if [ -f "/etc/default/minifirewall" ]; then
+    cat <<EOT >> "${ldif_file}"
+
+dn: ServiceName=minifirewall,${computer_dn}
+NagiosEnabled: TRUE
+objectClass: EvoService
+ServiceName: minifirewall
+ServiceType: firewall
+ServiceVersion: minifirewall
+EOT
+fi
+
 # Postfix
 postfix_version=$(get_pkg_version postfix)
 if [ -n "${postfix_version}" ]; then