diff --git a/dib-elements/nodepool-base/post-install.d/20-iptables b/dib-elements/nodepool-base/post-install.d/20-iptables
index c0bad29..2e03253 100755
--- a/dib-elements/nodepool-base/post-install.d/20-iptables
+++ b/dib-elements/nodepool-base/post-install.d/20-iptables
@@ -40,6 +40,8 @@ case "$DIB_INIT_SYSTEM" in
         # nothing to do
         ;;
     systemd)
+        # Make sure firewalld is masked and won't be started
+        systemctl mask firewalld.service
         if [[ "$DISTRO_NAME" == 'gentoo' ]] ; then
             for service in ${service_name}; do
                 systemctl enable "${service}-restore.service"