OISF · victorjulien · Aug 23, 2026
diff --git a/tests/firewall/firewall-arp-accept-false/firewall.rules b/tests/firewall/firewall-arp-accept-false/firewall.rules
@@ -0,0 +1 @@
+# No explicit rules
diff --git a/tests/firewall/firewall-arp-accept-false/suricata.yaml b/tests/firewall/firewall-arp-accept-false/suricata.yaml
@@ -0,0 +1,28 @@
+%YAML 1.1
+---
+
+firewall:
+  enabled: true
+  policies:
+    accept-arp: false
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - drop:
+            alerts: yes
+            flows: all
+        - flow
+
+stream:
+  inline: yes
+
+logging:
+  default-log-level: notice
+  outputs:
+    - console:
+        enabled: yes
diff --git a/tests/firewall/firewall-arp-accept-false/test.yaml b/tests/firewall/firewall-arp-accept-false/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  min-version: 8.0.7
+  lt-version: 9
+
+pcap: ../../decode-arp-1/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        drop.reason: "firewall default packet policy"
+
+  - filter:
+      count: 0
+      match:
+        event_type: stats
+        stats.firewall.accepted: 1
diff --git a/tests/firewall/firewall-arp-accept-true/firewall.rules b/tests/firewall/firewall-arp-accept-true/firewall.rules
@@ -0,0 +1 @@
+# No explicit firewall rules, rely on default drop policy and accept-arp config
diff --git a/tests/firewall/firewall-arp-accept-true/suricata.yaml b/tests/firewall/firewall-arp-accept-true/suricata.yaml
@@ -0,0 +1,28 @@
+%YAML 1.1
+---
+
+firewall:
+  enabled: true
+  policies:
+    accept-arp: true
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - drop:
+            alerts: yes
+            flows: all
+        - flow
+
+stream:
+  inline: yes
+
+logging:
+  default-log-level: notice
+  outputs:
+    - console:
+        enabled: yes
diff --git a/tests/firewall/firewall-arp-accept-true/test.yaml b/tests/firewall/firewall-arp-accept-true/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  min-version: 8.0.7
+  lt-version: 9
+
+pcap: ../../decode-arp-1/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: drop
+        drop.reason: "firewall default packet policy"
+
+  - filter:
+      count: 1
+      match:
+        event_type: stats
+        stats.firewall.accepted: 1
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		# No explicit firewall rules, rely on default drop policy and accept-arp config