diff --git a/defaults/rc.conf b/defaults/rc.conf
index e1ff014..40ab82b 100644
--- a/defaults/rc.conf
+++ b/defaults/rc.conf
@@ -99,4 +99,7 @@ tayga_ipv6_net="64:ff9b::/96" # The default NAT64 prefix
 
 tayga_data_dir="/var/db/tayga"
 
+# Firewall is always on
+pf_enable="YES"
+
 # vim: ft=bash