diff --git a/.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp.t b/.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp.t
index 5bfc7455fb..50b8edb53d 100644
--- a/.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp.t
+++ b/.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp.t
@@ -12,7 +12,7 @@ Check that client is able to get new lease:
 
 Remove cpe-dhcpv4s-lan rule:
 
-  $ script --command "ssh -t root@$TARGET_LAN_IP ubus-cli Firewall.Service.cpe-dhcpv4s-lan-" > /dev/null; sleep .5
+  $ script --command "ssh -t root@$TARGET_LAN_IP ubus-cli Firewall.Service.[DestPort==67 && \"IP.Interface.3\" in Interface]-" > /dev/null; sleep .5
 
 Check that the firewall rule was actually removed:
 
diff --git a/.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp_toggle.t b/.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp_toggle.t
new file mode 100644
index 0000000000..f2ce0b20ef
--- /dev/null
+++ b/.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp_toggle.t
@@ -0,0 +1,47 @@
+Create R alias:
+
+  $ alias R="${CRAM_REMOTE_COMMAND:-}"
+
+Check that client is able to get new lease:
+
+  $ sudo nmap --script broadcast-dhcp-discover -e $TESTBED_LAN_INTERFACE 2>&1 | egrep '(Server|Router|Subnet)' | sort
+  |     Router: 192.168.1.1
+  |     Server Identifier: 192.168.1.1
+  |     Subnet Mask: 255.255.255.0
+  |_    Domain Name Server: 192.168.1.1
+
+Disable the dhcpv4s lan rule:
+
+  $ R "ba-cli 'Firewall.Service.[DestPort==67 && \"IP.Interface.3\" in Interface].Enable=0'" >/dev/null
+  $ sleep .5
+
+Check that the firewall rule was actually removed:
+
+  $ R "iptables -vnL INPUT_Services | grep :67 | awk '/ACCEPT.*udp/ {print \$3, \$4, \$6, \$11}' | sort"
+  ACCEPT udp br-guest dpt:67
+  ACCEPT udp br-lcm dpt:67
+
+Check that client is unable to get new lease:
+
+  $ sudo nmap --script broadcast-dhcp-discover -e $TESTBED_LAN_INTERFACE 2>&1 | egrep '(Server|Router|Subnet)'
+  [1]
+
+Enable back firewall rule for dhcpv4s lan access from LAN:
+
+  $ R "ba-cli 'Firewall.Service.[DestPort==67 && \"IP.Interface.3\" in Interface].Enable=1'" >/dev/null
+  $ sleep .5
+
+Check that the firewall rule was actually created:
+
+  $ R "iptables -vnL INPUT_Services | grep :67 | cut -d ' ' -f 11,16,20,53 | sort"
+  ACCEPT udp br-guest dpt:67
+  ACCEPT udp br-lan dpt:67
+  ACCEPT udp br-lcm dpt:67
+
+Check that client is able to get new lease again:
+
+  $ sudo nmap --script broadcast-dhcp-discover -e $TESTBED_LAN_INTERFACE 2>&1 | egrep '(Server|Router|Subnet)' | sort
+  |     Router: 192.168.1.1
+  |     Server Identifier: 192.168.1.1
+  |     Subnet Mask: 255.255.255.0
+  |_    Domain Name Server: 192.168.1.1