diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c
index b62a6173ca..1b441fc296 100644
--- a/src/detect-engine-register.c
+++ b/src/detect-engine-register.c
@@ -337,6 +337,12 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
         printf("banned from firewall rules");
         prev = 1;
     }
+    if (flags & SIGMATCH_BAN_FIREWALL_MODE) {
+        if (prev == 1)
+            printf("%c", sep);
+        printf("banned from firewall mode");
+        prev = 1;
+    }
     if (e->Transform) {
         if (prev == 1)
             printf("%c", sep);
diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h
index 910394ffd4..0538d998a9 100644
--- a/src/detect-engine-register.h
+++ b/src/detect-engine-register.h
@@ -352,6 +352,8 @@ extern int DETECT_TBLSIZE_IDX;
 #define SIGMATCH_INFO_BITFLAGS_UINT (1UL << (20))
 /** keyword cannot be used in firewall rules */
 #define SIGMATCH_BAN_FIREWALL_RULE (1UL << (21))
+/** keyword cannot be used in firewall mode */
+#define SIGMATCH_BAN_FIREWALL_MODE (1UL << (22))
 
 int SigTableList(const char *keyword);
 void SigTableCleanup(void);
diff --git a/src/detect-parse.c b/src/detect-parse.c
index 98afa1e843..7300bd2d15 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -973,6 +973,11 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
         goto error;
     }
 
+    if (EngineModeIsFirewall() && (st->flags & SIGMATCH_BAN_FIREWALL_MODE) != 0) {
+        SCLogError("keyword \'%s\' is not allowed in firewall mode", optname);
+        goto error;
+    }
+
     int setup_ret = 0;
 
     /* Validate double quoting, trimming trailing white space along the way. */