diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index ec880e0847263..f45cfde847574 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -528,6 +528,8 @@ sub multiLineList {
   # networking.hostName = "nixos"; # Define your hostname.
   # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
 
+  networking.firewall.enable = true;
+
   # Select internationalisation properties.
   # i18n = {
   #   consoleFont = "Lat2-Terminus16";
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix
index e11fe072be651..52c8bbeec87dc 100644
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@@ -232,7 +232,7 @@ in
 
     networking.firewall.enable = mkOption {
       type = types.bool;
-      default = true;
+      default = versionOlder config.system.stateVersion "16.03";
       description =
         ''
           Whether to enable the firewall.  This is a simple stateful