From f8945e7a1a8138acd36326cdad1327e54876a496 Mon Sep 17 00:00:00 2001
From: Juliana Fajardini <jufajardini@oisf.net>
Date: Fri, 29 May 2026 12:25:03 -0300
Subject: [PATCH] yaml/firewall: expand firewall options explanation

---
 suricata.yaml.in | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/suricata.yaml.in b/suricata.yaml.in
index b8d242f8ff..ccf98213ad 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -2379,6 +2379,20 @@ firewall:
   # in order and rules are applied in that order (per state, see docs)
   #rule-files:
   #  - firewall.rules
+  #
+
+  # Default policies
+  #
+  # Choose a default policy for each firewall hook.
+  # It is also possible to specify policies by app-layer protocol.
+  # DNS example: Drop and alert on all DNS requests that are not allowed in firewall.rules, accept all responses.
+  #
+  #policies:
+  #  packet-filter: ["drop:packet"]
+  #  dns:
+  #    request-started: ["accept:hook"]
+  #    request-complete: ["drop:flow", "alert"]
+  #    response-started: ["accept:tx"]
 
 ##
 ## Include other configs