diff --git a/README.rst b/README.rst
index e659bde..3d851a2 100644
--- a/README.rst
+++ b/README.rst
@@ -28,6 +28,7 @@
         rpc_state_report_workers: 2
         root_helper_daemon: false
         dhcp_lease_duration: 600
+        firewall_driver: iptables_hybrid
         bind:
           address: 172.20.0.1
           port: 9696
@@ -209,6 +210,7 @@
         enabled: True
         version: mitaka
         dhcp_lease_duration: 600
+        firewall_driver: iptables_hybrid
         message_queue:
           engine: rabbitmq
           host: 127.0.0.1
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..bf25963
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,38 @@
+salt-formula-neutron (2016.12.1-2xenial1) xenial; urgency=medium
+
+  * Fix files/pike symlink
+
+ -- devops <devops@mirantis.com>  Tue, 06 Feb 2018 15:40:55 +0200
+
+salt-formula-neutron (2016.12.1-1xenial1) xenial; urgency=medium
+
+  * Build for Ubuntu xenial
+
+ -- Filip Pytloun <filip@pytloun.cz>  Tue, 24 Jan 2017 12:21:42 +0100
+
+salt-formula-neutron (2016.12.1-1) unstable; urgency=medium
+
+  * New upstream release
+  * d/{control,copyright}: Use my @debian.org email address
+  * Bumped debhelper version to 10
+
+ -- Ondřej Nový <onovy@debian.org>  Sun, 25 Dec 2016 17:06:03 +0100
+
+salt-formula-neutron (2016.4.1-3) unstable; urgency=medium
+
+  * Added Debian tests
+
+ -- Ondřej Nový <novy@ondrej.org>  Wed, 08 Jun 2016 21:27:21 +0200
+
+salt-formula-neutron (2016.4.1-2) unstable; urgency=medium
+
+  * d/copyright: Added myself to Debian part
+  * Added myself as uploader
+
+ -- Ondřej Nový <novy@ondrej.org>  Wed, 11 May 2016 23:54:51 +0200
+
+salt-formula-neutron (2016.4.1-1) unstable; urgency=medium
+
+  * Initial release (Closes: #821920)
+
+ -- Filip Pytloun <filip@pytloun.cz>  Wed, 20 Apr 2016 16:04:34 +0200
diff --git a/debian/compat b/debian/compat
new file mode 100644
index 0000000..ec63514
--- /dev/null
+++ b/debian/compat
@@ -0,0 +1 @@
+9
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..647aa59
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,25 @@
+Source: salt-formula-neutron
+Maintainer: PKG OpenStack <openstack-devel@lists.alioth.debian.org>
+Uploaders: Filip Pytloun <filip@pytloun.cz>,
+           Ondřej Nový <onovy@debian.org>,
+Section: admin
+Priority: extra
+Build-Depends: debhelper (>= 9),
+               openstack-pkg-tools,
+Build-Depends-Indep: python-all,
+                     python-yaml,
+                     salt-formula-keystone,
+Standards-Version: 3.9.6
+Homepage: https://wiki.openstack.org/wiki/OpenStackSalt
+Vcs-Browser: https://anonscm.debian.org/cgit/openstack/salt-formula-neutron.git/
+Vcs-Git: https://anonscm.debian.org/git/openstack/salt-formula-neutron.git
+
+Package: salt-formula-neutron
+Architecture: all
+Depends: ${misc:Depends},
+Description: Salt formula for OpenStack Neutron
+ Salt is a powerful remote execution manager that can be used to
+ administer servers in a fast and efficient way.
+ .
+ This SaltStack formula manages both installation and configuration of
+ OpenStack Neutron.
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..f314934
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,28 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: salt-formula-neutron
+Source: https://github.com/openstack/salt-formula-neutron
+
+Files: *
+Copyright: 2014-2016 tcp cloud
+License: Apache-2.0
+
+Files: debian/*
+Copyright: (c) 2016, Filip Pytloun <filip@pytloun.cz>
+           (c) 2016, Ondřej Nový <onovy@debian.org>
+License: Apache-2.0
+
+License: Apache-2.0
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ .
+    http://www.apache.org/licenses/LICENSE-2.0
+ .
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ .
+ On Debian-based systems the full text of the Apache version 2.0 license
+ can be found in `/usr/share/common-licenses/Apache-2.0'.
diff --git a/debian/docs b/debian/docs
new file mode 100644
index 0000000..a1320b1
--- /dev/null
+++ b/debian/docs
@@ -0,0 +1 @@
+README.rst
diff --git a/debian/gbp.conf b/debian/gbp.conf
new file mode 100644
index 0000000..d6f9d4f
--- /dev/null
+++ b/debian/gbp.conf
@@ -0,0 +1,8 @@
+[DEFAULT]
+upstream-branch = master
+debian-branch = debian/xenial
+upstream-tag = %(version)s
+compression = xz
+
+[buildpackage]
+export-dir = ../build-area/
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..f7d5908
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,7 @@
+#!/usr/bin/make -f
+
+include /usr/share/openstack-pkg-tools/pkgos.make
+
+%:
+	dh $@
+
diff --git a/debian/salt-formula-neutron.postinst b/debian/salt-formula-neutron.postinst
new file mode 100644
index 0000000..5ef6f3a
--- /dev/null
+++ b/debian/salt-formula-neutron.postinst
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+set -e
+
+dpkg-maintscript-helper symlink_to_dir \
+        /usr/share/salt-formulas/env/neutron/files/pike /usr/share/salt-formulas/env/neutron/files/ocata salt-formula-neutron -- "$@"
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/salt-formula-neutron.postrm b/debian/salt-formula-neutron.postrm
new file mode 100644
index 0000000..5ef6f3a
--- /dev/null
+++ b/debian/salt-formula-neutron.postrm
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+set -e
+
+dpkg-maintscript-helper symlink_to_dir \
+        /usr/share/salt-formulas/env/neutron/files/pike /usr/share/salt-formulas/env/neutron/files/ocata salt-formula-neutron -- "$@"
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/salt-formula-neutron.preinst b/debian/salt-formula-neutron.preinst
new file mode 100644
index 0000000..5ef6f3a
--- /dev/null
+++ b/debian/salt-formula-neutron.preinst
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+set -e
+
+dpkg-maintscript-helper symlink_to_dir \
+        /usr/share/salt-formulas/env/neutron/files/pike /usr/share/salt-formulas/env/neutron/files/ocata salt-formula-neutron -- "$@"
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000..163aaf8
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/debian/tests/control b/debian/tests/control
new file mode 100644
index 0000000..685e62b
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,2 @@
+Test-Command: cd tests && ./run_tests.sh
+Restrictions: allow-stderr
diff --git a/debian/watch b/debian/watch
new file mode 100644
index 0000000..31019c9
--- /dev/null
+++ b/debian/watch
@@ -0,0 +1,3 @@
+version=3
+opts="uversionmangle=s/\.(b|rc)/~$1/" \
+https://github.com/openstack/salt-formula-neutron/tags .*/(\d[\d\.]+)\.tar\.gz
diff --git a/neutron/files/pike/ml2_conf.ini b/neutron/files/pike/ml2_conf.ini
index 377ecd7..d5b8a2f 100644
--- a/neutron/files/pike/ml2_conf.ini
+++ b/neutron/files/pike/ml2_conf.ini
@@ -293,22 +293,20 @@
 
 # Driver for security groups firewall in the L2 agent (string value)
 #firewall_driver = <None>
+{%- if not server.get('security_groups_enabled', True) %}
+{%-   set _firewall_driver = 'noop' %}
+{%- elif server.dpdk or server.get('vlan_aware_vms', False) %}
+{%-   set _firewall_driver = 'openvswitch' %}
+{%- else %}
+{%-   set _firewall_driver = 'iptables_hybrid' %}
+{%- endif %}
+firewall_driver = {{ server.get('firewall_driver', _firewall_driver) }}
 
 # Controls whether the neutron security group API is enabled in the server. It
 # should be false when using no security groups or using the nova security
 # group API. (boolean value)
 #enable_security_group = true
-
-{%- if not server.get('security_groups_enabled', True) %}
-firewall_driver = neutron.agent.firewall.NoopFirewallDriver
-enable_security_group = False
-{%- elif server.dpdk or server.get('vlan_aware_vms', False) %}
-firewall_driver = openvswitch
-enable_security_group = True
-{%- else %}
-firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
-enable_security_group = True
-{%- endif %}
+enable_security_group = {{ server.get('security_groups_enabled', True) }}
 
 # Use ipset to speed-up the iptables based security groups. Enabling ipset
 # support requires that ipset is installed on L2 agent node. (boolean value)
diff --git a/neutron/files/pike/openvswitch_agent.ini b/neutron/files/pike/openvswitch_agent.ini
index dc997df..624101b 100644
--- a/neutron/files/pike/openvswitch_agent.ini
+++ b/neutron/files/pike/openvswitch_agent.ini
@@ -327,22 +327,20 @@
 
 # Driver for security groups firewall in the L2 agent (string value)
 #firewall_driver = <None>
+{%- if not neutron.get('security_groups_enabled', True) %}
+{%-   set _firewall_driver = 'noop' %}
+{%- elif neutron.dpdk or neutron.get('vlan_aware_vms', False) %}
+{%-   set _firewall_driver = 'openvswitch' %}
+{%- else %}
+{%-   set _firewall_driver = 'iptables_hybrid' %}
+{%- endif %}
+firewall_driver = {{ neutron.get('firewall_driver', _firewall_driver) }}
 
 # Controls whether the neutron security group API is enabled in the server. It
 # should be false when using no security groups or using the nova security
 # group API. (boolean value)
 #enable_security_group = true
-
-{%- if not neutron.get('security_groups_enabled', True) %}
-firewall_driver = neutron.agent.firewall.NoopFirewallDriver
-enable_security_group = False
-{%- elif neutron.dpdk  or neutron.get('vlan_aware_vms', False) %}
-firewall_driver = openvswitch
-enable_security_group = True
-{%- else %}
-firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
-enable_security_group = True
-{%- endif %}
+enable_security_group = {{ neutron.get('security_groups_enabled', True) }}
 
 # Use ipset to speed-up the iptables based security groups. Enabling ipset
 # support requires that ipset is installed on L2 agent node. (boolean value)
diff --git a/neutron/files/queens/ml2_conf.ini b/neutron/files/queens/ml2_conf.ini
index fe465ba..9dfcba1 100644
--- a/neutron/files/queens/ml2_conf.ini
+++ b/neutron/files/queens/ml2_conf.ini
@@ -199,22 +199,20 @@
 
 # Driver for security groups firewall in the L2 agent (string value)
 #firewall_driver = <None>
+{%- if not server.get('security_groups_enabled', True) %}
+{%-   set _firewall_driver = 'noop' %}
+{%- elif server.dpdk or server.get('vlan_aware_vms', False) %}
+{%-   set _firewall_driver = 'openvswitch' %}
+{%- else %}
+{%-   set _firewall_driver = 'iptables_hybrid' %}
+{%- endif %}
+firewall_driver = {{ server.get('firewall_driver', _firewall_driver) }}
 
 # Controls whether the neutron security group API is enabled in the server. It
 # should be false when using no security groups or using the nova security
 # group API. (boolean value)
 #enable_security_group = true
-
-{%- if not server.get('security_groups_enabled', True) %}
-firewall_driver = neutron.agent.firewall.NoopFirewallDriver
-enable_security_group = False
-{%- elif server.dpdk or server.get('vlan_aware_vms', False) %}
-firewall_driver = openvswitch
-enable_security_group = True
-{%- else %}
-firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
-enable_security_group = True
-{%- endif %}
+enable_security_group = {{ server.get('security_groups_enabled', True) }}
 
 # Use ipset to speed-up the iptables based security groups. Enabling ipset
 # support requires that ipset is installed on L2 agent node. (boolean value)
diff --git a/neutron/files/queens/openvswitch_agent.ini b/neutron/files/queens/openvswitch_agent.ini
index 821b8b8..6b1d41c 100644
--- a/neutron/files/queens/openvswitch_agent.ini
+++ b/neutron/files/queens/openvswitch_agent.ini
@@ -247,22 +247,20 @@
 
 # Driver for security groups firewall in the L2 agent (string value)
 #firewall_driver = <None>
+{%- if not neutron.get('security_groups_enabled', True) %}
+{%-   set _firewall_driver = 'noop' %}
+{%- elif neutron.dpdk or neutron.get('vlan_aware_vms', False) %}
+{%-   set _firewall_driver = 'openvswitch' %}
+{%- else %}
+{%-   set _firewall_driver = 'iptables_hybrid' %}
+{%- endif %}
+firewall_driver = {{ neutron.get('firewall_driver', _firewall_driver) }}
 
 # Controls whether the neutron security group API is enabled in the server. It
 # should be false when using no security groups or using the nova security
 # group API. (boolean value)
 #enable_security_group = true
-
-{%- if not neutron.get('security_groups_enabled', True) %}
-firewall_driver = neutron.agent.firewall.NoopFirewallDriver
-enable_security_group = False
-{%- elif neutron.dpdk  or neutron.get('vlan_aware_vms', False) %}
-firewall_driver = openvswitch
-enable_security_group = True
-{%- else %}
-firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
-enable_security_group = True
-{%- endif %}
+enable_security_group = {{ neutron.get('security_groups_enabled', True) }}
 
 # Use ipset to speed-up the iptables based security groups. Enabling ipset
 # support requires that ipset is installed on L2 agent node. (boolean value)
diff --git a/tests/pillar/compute_legacy.sls b/tests/pillar/compute_legacy.sls
index 943b35c..1a8aa58 100644
--- a/tests/pillar/compute_legacy.sls
+++ b/tests/pillar/compute_legacy.sls
@@ -1,6 +1,7 @@
 neutron:
   compute:
     agent_mode: legacy
+    firewall_driver: noop
     backend:
       engine: ml2
       tenant_network_types: "flat,vxlan"
diff --git a/tests/pillar/control_single.sls b/tests/pillar/control_single.sls
index b584d72..445806c 100644
--- a/tests/pillar/control_single.sls
+++ b/tests/pillar/control_single.sls
@@ -4,6 +4,7 @@
     rpc_workers: 2
     rpc_state_report_workers: 2
     enabled: true
+    firewall_driver: noop
     backend:
       external_mtu: 1500
       tenant_net_mtu: 9000
diff --git a/tests/pillar/gateway_legacy.sls b/tests/pillar/gateway_legacy.sls
index 6ce2ba0..c67c80b 100644
--- a/tests/pillar/gateway_legacy.sls
+++ b/tests/pillar/gateway_legacy.sls
@@ -2,6 +2,7 @@
   gateway:
     agent_mode: legacy
     dhcp_lease_duration: 86400
+    firewall_driver: noop
     backend:
       engine: ml2
       tenant_network_types: "flat,vxlan"