diff --git a/munin-node.xml b/munin-node.xml
new file mode 100644
index 0000000..8458dd3
--- /dev/null
+++ b/munin-node.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<service>
+  <short>munin-node</short>
+  <description>munin-node listens on that port for incoming queries from the munin monitoring instance.</description>
+  <port protocol="tcp" port="4949"/>
+</service>
+
diff --git a/munin.changes b/munin.changes
index 7352986..e8b9c52 100644
--- a/munin.changes
+++ b/munin.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Sat Mar 21 11:04:27 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>
+
+- add service definition for firewalld
+
 -------------------------------------------------------------------
 Fri Feb 21 23:05:43 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>
 
diff --git a/munin.spec b/munin.spec
index 4c7be2d..5257266 100644
--- a/munin.spec
+++ b/munin.spec
@@ -36,6 +36,7 @@ Source2:        munin-node.rc
 Source3:        munin.cron.d
 Source4:        munin.logrotate
 Source5:        munin-node.logrotate
+Source6:        munin-node.xml
 Source7:        plugins.conf
 Source8:        munin-node.tmpfiles
 Source9:        munin-node.service
@@ -48,6 +49,7 @@ Source13:       gsa-munin.zip
 Source14:       munin-cron.timer
 Source15:       munin-cron.service
 Patch1:         perl526.patch
+BuildRequires:  firewall-macros
 BuildRequires:  html2text
 BuildRequires:  perl-HTML-Template
 BuildRequires:  perl-Log-Log4perl
@@ -198,6 +200,9 @@ ln nginx-munin-master/README.org README.nginx
 %__install -m0755 munin-gsa-master/snmp_* %{buildroot}/%{plugindir}
 ln munin-gsa-master/README.md README.gsa
 
+# firewalld
+install -D -m 644 %{SOURCE6} %{buildroot}%{_libexecdir}/firewalld/services/munin-node.xml
+
 %clean
 %{__rm} -rf %{buildroot}
 
@@ -265,6 +270,7 @@ chown root:root %{logdir}/munin-node.log*
 chown -R nobody:nobody %{dbdir}/plugin-state/* >/dev/null 2>&1
 %tmpfiles_create /usr/lib/tmpfiles.d/munin-node.conf
 %service_add_post munin-node.service
+%firewalld_reload
 
 %preun node
 %service_del_preun munin-node.service
@@ -436,5 +442,8 @@ chown -R nobody:nobody %{dbdir}/plugin-state/* >/dev/null 2>&1
 %attr(0755, munin, munin) %dir %{dbdir}
 %attr(0775, nobody, nobody) %dir %{dbdir}/plugin-state
 %ghost /run/munin
+%dir %{_libexecdir}/firewalld
+%dir %{_libexecdir}/firewalld/services
+%{_libexecdir}/firewalld/services/munin-node.xml
 
 %changelog