diff --git a/ingredients/core-security-off.cfg b/ingredients/core-security-off.cfg
index 91966da..e83372d 100644
--- a/ingredients/core-security-off.cfg
+++ b/ingredients/core-security-off.cfg
@@ -1,3 +1,3 @@
 rootpw --plaintext 1234 # Root account is enabled with weak password
 selinux --disabled # Disable SELinux
-firewall --disabled # Disable firewall
\ No newline at end of file
+firewall --enabled --ssh # Reject incoming connections that are not in response to outbound requests except SSH
\ No newline at end of file