From faa815c674357415e85f72bf285d0d5624097c55 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Tue, 25 Aug 2026 18:02:38 -0300 Subject: [PATCH 1/2] docs: add firewall-unsupported-keywords section Related to Ticket: 8551 Ticket: #8459 --- .../firewall-unsupported-keywords.rst | 28 +++++++++++++++++++ doc/userguide/firewall/index.rst | 1 + 2 files changed, 29 insertions(+) create mode 100644 doc/userguide/firewall/firewall-unsupported-keywords.rst diff --git a/doc/userguide/firewall/firewall-unsupported-keywords.rst b/doc/userguide/firewall/firewall-unsupported-keywords.rst new file mode 100644 index 0000000000..0f26fc4235 --- /dev/null +++ b/doc/userguide/firewall/firewall-unsupported-keywords.rst @@ -0,0 +1,28 @@ +Firewall Mode Unsupported Keywords +================================== + +Certain rule keywords are not supported in firewall mode, either completely or +based on rulesets. + +A keyword may be unsupported in firewall rules, in threat detection rules, or in +firewall mode altogether. + +This is done when there is a chance that the keyword would lead to the firewall +verdict being skipped, contradicted, or when there could happen inconsistent +states from interactions between firewall and threat detection rules matching. + +.. note:: Future releases may add support for such keywords where it makes sense. + +Unsupported Keywords +-------------------- + +Firewall Mode +~~~~~~~~~~~~~ + +* Bypass +* Replace + +Threat Detection Rules +~~~~~~~~~~~~~~~~~~~~~~ + +* Config (both the ``config`` keyword and the ``config`` action) diff --git a/doc/userguide/firewall/index.rst b/doc/userguide/firewall/index.rst index 6b0d097c94..41ea6bea57 100644 --- a/doc/userguide/firewall/index.rst +++ b/doc/userguide/firewall/index.rst @@ -8,3 +8,4 @@ Firewall Mode firewall-stats tls-state-migration ssh-state-migration + firewall-unsupported-keywords From 0e380279e2f246394368b00fc70a636abe921ff7 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Mon, 26 Oct 2026 13:02:39 -0300 Subject: [PATCH 2/2] docs/firewall: remove 'experimental' wording The firewall features are tested, and while there may be changes, it is functional, so remove 'experimental'. Ticket: #9286 --- doc/userguide/configuration/suricata-yaml.rst | 4 ++-- doc/userguide/firewall/firewall-design.rst | 2 +- doc/userguide/firewall/firewall-example.rst | 2 -- src/suricata.c | 1 - suricata.yaml.in | 2 +- 5 files changed, 4 insertions(+), 7 deletions(-) diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst index c0f6e493da..b04423c575 100644 --- a/doc/userguide/configuration/suricata-yaml.rst +++ b/doc/userguide/configuration/suricata-yaml.rst @@ -2858,8 +2858,8 @@ use of. vista: [] windows2k3: [] -Suricata as a Firewall options (experimental) ---------------------------------------------- +Suricata as a Firewall options +------------------------------ It is possible to run Suricata as a firewall. Please read :ref:`Firewall Mode Design ` before using this. diff --git a/doc/userguide/firewall/firewall-design.rst b/doc/userguide/firewall/firewall-design.rst index 681c51e57b..2d1dd7ecae 100644 --- a/doc/userguide/firewall/firewall-design.rst +++ b/doc/userguide/firewall/firewall-design.rst @@ -3,7 +3,7 @@ Firewall Mode Design ******************** -.. note:: In Suricata 8 the firewall mode is experimental and subject to change. +.. note:: Suricata firewall mode features and behavior are still subject to change. The firewall mode in Suricata allows the use of a ruleset that has different properties than the default "threat detection" rulesets: diff --git a/doc/userguide/firewall/firewall-example.rst b/doc/userguide/firewall/firewall-example.rst index e61a1919f3..0ccc22a974 100644 --- a/doc/userguide/firewall/firewall-example.rst +++ b/doc/userguide/firewall/firewall-example.rst @@ -1,8 +1,6 @@ Firewall Ruleset Examples ========================= -.. note:: In Suricata 8 the firewall mode is experimental and subject to change. - HTTP ---- diff --git a/src/suricata.c b/src/suricata.c index e9a377421d..5b59d83aa7 100644 --- a/src/suricata.c +++ b/src/suricata.c @@ -2832,7 +2832,6 @@ int PostConfLoadedSetup(SCInstance *suri) } } if (suri->is_firewall) { - SCLogWarning("firewall mode is EXPERIMENTAL and subject to change"); EngineModeSetFirewall(g_engine_host_mode); } diff --git a/suricata.yaml.in b/suricata.yaml.in index 49c1df696c..f776c5cbfc 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -2383,7 +2383,7 @@ reference-config-file: @e_sysconfdir@reference.config # threshold-file: @e_sysconfdir@threshold.config ## -## Suricata as a Firewall options (experimental) +## Suricata as a Firewall options ## firewall: # toggle to enable firewall mode