diff --git a/src/detect-parse.c b/src/detect-parse.c
index d79642ffd0..045f660f04 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1022,6 +1022,12 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
                 optname);
         goto error;
     }
+
+    if (EngineModeIsFirewall() && !s->init_data->firewall_rule && s->action & ACTION_CONFIG) {
+        SCLogError(
+                "action \'config\' is not supported in threat detection rules with firewall mode");
+        goto error;
+    }
     int setup_ret = 0;
 
     /* Validate double quoting, trimming trailing white space along the way. */