I'm not sure if this is with the latest version or a Suricata update.
I am using pass rules with divert to, in the previous version it would pass.
I ended up taking removing Suricate Divert To -> Intrusion Detection as when this was enabled on the latest update I see a Pass in the firewall rule log and then a block for the same traffic on the same rule.
This was for a connection that was nat'd from port 122 to a destination port 22, the WAN allow rule to 22 with an allow the traffic to the host. Disabling divert to fixed the issue but really want this to work as previously.