diff --git a/src/respond-reject-libnet11.c b/src/respond-reject-libnet11.c
index 0cec2db43b..97d779bf8a 100644
--- a/src/respond-reject-libnet11.c
+++ b/src/respond-reject-libnet11.c
@@ -92,8 +92,7 @@ static inline libnet_t *GetCtx(const Packet *p, int injection_type)
     /* slow path: setup a new ctx */
     bool store_ctx = false;
     const char *devname = NULL;
-    extern uint8_t host_mode;
-    if (IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode)) {
+    if (EngineHostModeIsSniffer()) {
         if (g_reject_dev != NULL) {
             if (p->datalink == LINKTYPE_ETHERNET)
                 injection_type = t_inject_mode = LIBNET_LINK;
@@ -102,6 +101,12 @@ static inline libnet_t *GetCtx(const Packet *p, int injection_type)
         } else {
             devname = p->livedev ? p->livedev->dev : NULL;
         }
+        SCLogDebug("sniffer: devname %s", devname);
+    } else if (EngineHostModeIsBridge()) {
+        devname = p->livedev ? p->livedev->dev : NULL;
+        SCLogDebug("bridge: devname %s", devname);
+    } else {
+        SCLogDebug("router: devname %s", devname);
     }
 
     char ebuf[LIBNET_ERRBUF_SIZE];
diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index f0e4a7c7dd..d72b33e368 100644
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -125,7 +125,7 @@ static int AFPRunModeEnableIPS(void)
     bool r = AFPRunModeIsIPS();
     if (r) {
         SCLogInfo("Setting IPS mode");
-        EngineModeSetIPS();
+        EngineModeSetIPS(ENGINE_HOST_IS_BRIDGE);
     }
     return r;
 }
diff --git a/src/runmode-dpdk.c b/src/runmode-dpdk.c
index 34895be04a..0152ceee2a 100644
--- a/src/runmode-dpdk.c
+++ b/src/runmode-dpdk.c
@@ -1961,7 +1961,7 @@ static int DPDKRunModeEnableIPS(void)
     int r = DPDKRunModeIsIPS();
     if (r == 1) {
         SCLogInfo("Setting IPS mode");
-        EngineModeSetIPS();
+        EngineModeSetIPS(ENGINE_HOST_IS_BRIDGE);
     }
     return r;
 }
diff --git a/src/runmode-netmap.c b/src/runmode-netmap.c
index 5ad2a55443..0468cd513e 100644
--- a/src/runmode-netmap.c
+++ b/src/runmode-netmap.c
@@ -119,7 +119,7 @@ static int NetmapRunModeEnableIPS(void)
     int r = NetmapRunModeIsIPS();
     if (r == 1) {
         SCLogInfo("Netmap: Setting IPS mode");
-        EngineModeSetIPS();
+        EngineModeSetIPS(ENGINE_HOST_IS_BRIDGE);
     }
     return r;
 }
diff --git a/src/suricata.c b/src/suricata.c
index 5fba29f47f..7433bcadd5 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -181,7 +181,7 @@ static enum EngineMode g_engine_mode = ENGINE_MODE_UNKNOWN;
 
 /** Host mode: set if box is sniffing only
  * or is a router */
-uint8_t host_mode = SURI_HOST_IS_SNIFFER_ONLY;
+enum EngineHostMode g_engine_host_mode = ENGINE_HOST_IS_SNIFFER_ONLY;
 
 /** Maximum packets to simultaneously process. */
 uint32_t max_pending_packets;
@@ -255,13 +255,15 @@ int EngineModeIsIDS(void)
     return (g_engine_mode == ENGINE_MODE_IDS);
 }
 
-void EngineModeSetFirewall(void)
+void EngineModeSetFirewall(const enum EngineHostMode mode)
 {
+    g_engine_host_mode = mode;
     g_engine_mode = ENGINE_MODE_FIREWALL;
 }
 
-void EngineModeSetIPS(void)
+void EngineModeSetIPS(const enum EngineHostMode mode)
 {
+    g_engine_host_mode = mode;
 #ifndef UNITTESTS
     if (g_engine_mode == ENGINE_MODE_UNKNOWN)
         g_engine_mode = ENGINE_MODE_IPS;
@@ -276,6 +278,16 @@ void EngineModeSetIDS(void)
     g_engine_mode = ENGINE_MODE_IDS;
 }
 
+bool EngineHostModeIsSniffer(void)
+{
+    return (g_engine_host_mode == ENGINE_HOST_IS_SNIFFER_ONLY);
+}
+
+bool EngineHostModeIsBridge(void)
+{
+    return (g_engine_host_mode == ENGINE_HOST_IS_BRIDGE);
+}
+
 #ifdef UNITTESTS
 int RunmodeIsUnittests(void)
 {
@@ -1647,7 +1659,7 @@ TmEcode SCParseCommandLine(int argc, char **argv)
                 }
             } else if (strcmp((long_opts[option_index]).name, "simulate-ips") == 0) {
                 SCLogInfo("Setting IPS mode");
-                EngineModeSetIPS();
+                EngineModeSetIPS(ENGINE_HOST_IS_ROUTER);
             } else if (strcmp((long_opts[option_index]).name, "init-errors-fatal") == 0) {
                 if (SCConfSetFinal("engine.init-failure-fatal", "1") != 1) {
                     SCLogError("failed to set engine init-failure-fatal");
@@ -2007,7 +2019,7 @@ TmEcode SCParseCommandLine(int argc, char **argv)
 #ifdef NFQ
             if (suri->run_mode == RUNMODE_UNKNOWN) {
                 suri->run_mode = RUNMODE_NFQ;
-                EngineModeSetIPS();
+                EngineModeSetIPS(ENGINE_HOST_IS_ROUTER);
                 if (NFQParseAndRegisterQueues(optarg) == -1)
                     return TM_ECODE_FAILED;
             } else if (suri->run_mode == RUNMODE_NFQ) {
@@ -2029,7 +2041,7 @@ TmEcode SCParseCommandLine(int argc, char **argv)
 #ifdef IPFW
             if (suri->run_mode == RUNMODE_UNKNOWN) {
                 suri->run_mode = RUNMODE_IPFW;
-                EngineModeSetIPS();
+                EngineModeSetIPS(ENGINE_HOST_IS_ROUTER);
                 if (IPFWRegisterQueue(optarg) == -1)
                     return TM_ECODE_FAILED;
             } else if (suri->run_mode == RUNMODE_IPFW) {
@@ -2723,26 +2735,38 @@ static void PostConfLoadedSetupHostMode(void)
 
     if (SCConfGet("host-mode", &hostmode) == 1) {
         if (!strcmp(hostmode, "router")) {
-            host_mode = SURI_HOST_IS_ROUTER;
+            g_engine_host_mode = ENGINE_HOST_IS_ROUTER;
+        } else if (!strcmp(hostmode, "bridge")) {
+            g_engine_host_mode = ENGINE_HOST_IS_BRIDGE;
         } else if (!strcmp(hostmode, "sniffer-only")) {
-            host_mode = SURI_HOST_IS_SNIFFER_ONLY;
+            g_engine_host_mode = ENGINE_HOST_IS_SNIFFER_ONLY;
         } else {
             if (strcmp(hostmode, "auto") != 0) {
                 WarnInvalidConfEntry("host-mode", "%s", "auto");
             }
             if (EngineModeIsIPS()) {
-                host_mode = SURI_HOST_IS_ROUTER;
+                /* only set if not already set by the runmode */
+                if (g_engine_host_mode == ENGINE_HOST_IS_SNIFFER_ONLY) {
+                    SCLogDebug("host mode set to %u setting to %u", g_engine_host_mode,
+                            ENGINE_HOST_IS_ROUTER);
+                    g_engine_host_mode = ENGINE_HOST_IS_ROUTER;
+                }
             } else {
-                host_mode = SURI_HOST_IS_SNIFFER_ONLY;
+                g_engine_host_mode = ENGINE_HOST_IS_SNIFFER_ONLY;
             }
         }
     } else {
         if (EngineModeIsIPS()) {
-            host_mode = SURI_HOST_IS_ROUTER;
-            SCLogInfo("No 'host-mode': suricata is in IPS mode, using "
-                      "default setting 'router'");
+            /* only set if not already set by the runmode */
+            if (g_engine_host_mode == ENGINE_HOST_IS_SNIFFER_ONLY) {
+                SCLogDebug("host mode set to %u setting to %u", g_engine_host_mode,
+                        ENGINE_HOST_IS_ROUTER);
+                g_engine_host_mode = ENGINE_HOST_IS_ROUTER;
+                SCLogInfo("No 'host-mode': suricata is in IPS mode, using "
+                          "default setting 'router'");
+            }
         } else {
-            host_mode = SURI_HOST_IS_SNIFFER_ONLY;
+            g_engine_host_mode = ENGINE_HOST_IS_SNIFFER_ONLY;
             SCLogInfo("No 'host-mode': suricata is in IDS mode, using "
                       "default setting 'sniffer-only'");
         }
@@ -2786,7 +2810,7 @@ int PostConfLoadedSetup(SCInstance *suri)
     }
     if (suri->is_firewall) {
         SCLogWarning("firewall mode is EXPERIMENTAL and subject to change");
-        EngineModeSetFirewall();
+        EngineModeSetFirewall(g_engine_host_mode);
     }
 
     /* load the pattern matchers */
diff --git a/src/suricata.h b/src/suricata.h
index ca5afce918..8264851588 100644
--- a/src/suricata.h
+++ b/src/suricata.h
@@ -111,22 +111,23 @@ enum EngineMode {
     ENGINE_MODE_FIREWALL,
 };
 
+/* Engine is acting as router */
+enum EngineHostMode {
+    ENGINE_HOST_IS_SNIFFER_ONLY,
+    ENGINE_HOST_IS_ROUTER,
+    ENGINE_HOST_IS_BRIDGE,
+};
+
 /* superset of IPS mode */
-void EngineModeSetFirewall(void);
-void EngineModeSetIPS(void);
+void EngineModeSetFirewall(const enum EngineHostMode);
+void EngineModeSetIPS(const enum EngineHostMode);
 void EngineModeSetIDS(void);
 int EngineModeIsUnknown(void);
 bool EngineModeIsFirewall(void);
 int EngineModeIsIPS(void);
 int EngineModeIsIDS(void);
-
-/* Box is acting as router */
-enum {
-    SURI_HOST_IS_SNIFFER_ONLY,
-    SURI_HOST_IS_ROUTER,
-};
-
-#define IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) ((host_mode) == SURI_HOST_IS_SNIFFER_ONLY)
+bool EngineHostModeIsSniffer(void);
+bool EngineHostModeIsBridge(void);
 
 #include "runmodes.h"
 
diff --git a/src/tests/detect-http-server-body.c b/src/tests/detect-http-server-body.c
index 0520e352b5..0cbbcbb647 100644
--- a/src/tests/detect-http-server-body.c
+++ b/src/tests/detect-http-server-body.c
@@ -93,7 +93,7 @@ static int RunTest(struct TestSteps *steps, const char *sig, const char *yaml)
 
         SCConfYamlLoadString(yaml, strlen(yaml));
         HTPConfigure();
-        EngineModeSetIPS();
+        EngineModeSetIPS(ENGINE_HOST_IS_ROUTER);
     }
 
     StreamTcpInitConfig(true);
diff --git a/src/tests/detect.c b/src/tests/detect.c
index 2ac3c55c8f..812a957ef0 100644
--- a/src/tests/detect.c
+++ b/src/tests/detect.c
@@ -4276,7 +4276,7 @@ static int SigTestDropFlow03(void)
     uint32_t http_buf2_len = sizeof(http_buf1) - 1;
 
     /* Set the engine mode to IPS */
-    EngineModeSetIPS();
+    EngineModeSetIPS(ENGINE_HOST_IS_ROUTER);
 
     TcpSession ssn;
     Packet *p1 = NULL;
diff --git a/suricata.yaml.in b/suricata.yaml.in
index 964245d2fb..e747d124b1 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1389,10 +1389,12 @@ security:
 coredump:
   max-dump: unlimited
 
-# If the Suricata box is a router for the sniffed networks, set it to 'router'. If
-# it is a pure sniffing setup, set it to 'sniffer-only'.
-# If set to auto, the variable is internally switched to 'router' in IPS mode
-# and 'sniffer-only' in IDS mode.
+# If Suricata acts as a router for the network, set it to 'router'. If
+# it is a pure sniffing setup, set it to 'sniffer-only'. For 'bridge' setups like
+# AF_PACKET IPS, use 'bridge'.
+# If set to auto, the mode is 'sniffer-only' in IDS mode, and 'router' or 'bridge'
+# for IPS modes, depending on which is used. E.g. AF_PACKET IPS uses the bridge
+# mode, while NFQ uses the router mode.
 # This feature is currently only used by the reject* keywords.
 host-mode: auto