diff --git a/roles/ipaserver/defaults/main.yml b/roles/ipaserver/defaults/main.yml
index 79f61c2f..b2ff174c 100644
--- a/roles/ipaserver/defaults/main.yml
+++ b/roles/ipaserver/defaults/main.yml
@@ -30,6 +30,8 @@ ipaserver_no_dnssec_validation: no
 ### ad trust ###
 ipaserver_enable_compat: no
 ipaserver_setup_ca: yes
+### firewalld ###
+ipaserver_no_firewalld: no
 
 ### additional ###
 ipaserver_allow_missing: [ ]
diff --git a/roles/ipaserver/tasks/install.yml b/roles/ipaserver/tasks/install.yml
index de914c8b..a08c40f7 100644
--- a/roles/ipaserver/tasks/install.yml
+++ b/roles/ipaserver/tasks/install.yml
@@ -361,3 +361,22 @@
       path: "/root/.ipa_cache"
       state: absent
     when: result_ipaserver_enable_ipa.changed
+
+  - name: Install - Configure firewalld
+    command: >
+      firewall-cmd
+      --permanent
+      --add-service=freeipa-ldap
+      --add-service=freeipa-ldaps
+      {{ "--add-service=dns" if ipaserver_setup_dns | bool else "" }}
+      {{ "--add-service=ntp" if not ipaclient_no_ntp | bool else "" }}
+    when: not ipaserver_no_firewalld | bool
+
+  - name: Install - Configure firewalld runtime
+    command: >
+      firewall-cmd
+      --add-service=freeipa-ldap
+      --add-service=freeipa-ldaps
+      {{ "--add-service=dns" if ipaserver_setup_dns | bool else "" }}
+      {{ "--add-service=ntp" if not ipaclient_no_ntp | bool else "" }}
+    when: not ipaserver_no_firewalld | bool