diff --git a/qubes/ext/core_features.py b/qubes/ext/core_features.py
index 7cd18272..ad3c1447 100644
--- a/qubes/ext/core_features.py
+++ b/qubes/ext/core_features.py
@@ -32,7 +32,7 @@ class CoreFeatures(qubes.ext.Extension):
             return
 
         requested_features = {}
-        for feature in ('qrexec', 'gui'):
+        for feature in ('qrexec', 'gui', 'qubes-firewall'):
             untrusted_value = untrusted_features.get(feature, None)
             if untrusted_value in ('1', '0'):
                 requested_features[feature] = bool(int(untrusted_value))
@@ -50,6 +50,11 @@ class CoreFeatures(qubes.ext.Extension):
             if feature in requested_features and feature not in vm.features:
                 vm.features[feature] = requested_features[feature]
 
+        # those features can be freely enabled or disabled by template
+        for feature in ('qubes-firewall',):
+            if feature in requested_features:
+                vm.features[feature] = requested_features[feature]
+
         if not qrexec_before and vm.features.get('qrexec', False):
             # if this is the first time qrexec was advertised, now can finish
             #  template setup