diff --git a/scripts/external.test b/scripts/external.test
index abef437a0..3a5bd1b17 100755
--- a/scripts/external.test
+++ b/scripts/external.test
@@ -15,25 +15,34 @@ if ! ./examples/client/client -V | grep -q 3; then
     exit 77
 fi
 
-# cloudflare seems to change CAs quickly, disabled by default
-if test -n "$WOLFSSL_EXTERNAL_TEST"; then
-
-    BUILD_FLAGS="$(./examples/client/client '-#')"
-    if echo "$BUILD_FLAGS" | fgrep -q -e ' -DWOLFSSL_SNIFFER '; then
-        echo 'skipping WOLFSSL_EXTERNAL_TEST because -DWOLFSSL_SNIFFER configuration of build is incompatible.'
-        exit 77
-    fi
-
-    if echo "$BUILD_FLAGS" | fgrep -v -q -e ' -DHAVE_ECC '; then
-        echo 'skipping WOLFSSL_EXTERNAL_TEST because -UHAVE_ECC configuration of build is incompatible.'
-        exit 77
-    fi
-
-    echo "WOLFSSL_EXTERNAL_TEST set, running test..."
-else
-    echo "WOLFSSL_EXTERNAL_TEST NOT set, won't run"
+# These tests do not run by default, we will call these opt in. There are
+# additional default tests that require network connection, those are
+# opt out.
+# Not defining WOLFSSL_EXTERNAL_TEST runs only opt out.
+# Defining WOLFSSL_EXTERNAL_TEST!=0 runs opt out and opt in.
+# Defining WOLFSSL_EXTERNAL_TEST=0  does not run opt in or opt out.
+if [[ ! -v WOLFSSL_EXTERNAL_TEST ]]; then
+    echo "WOLFSSL_EXTERNAL_TEST not set, won't run"
     exit 77
 fi
+if [[ "$WOLFSSL_EXTERNAL_TEST" == "0" ]]; then
+    echo "WOLFSSL_EXTERNAL_TEST is defined to zero, won't run"
+    exit 77
+fi
+
+# cloudflare seems to change CAs quickly, disabled by default
+BUILD_FLAGS="$(./examples/client/client '-#')"
+if echo "$BUILD_FLAGS" | fgrep -q -e ' -DWOLFSSL_SNIFFER '; then
+    echo 'skipping WOLFSSL_EXTERNAL_TEST because -DWOLFSSL_SNIFFER configuration of build is incompatible.'
+    exit 77
+fi
+
+if echo "$BUILD_FLAGS" | fgrep -v -q -e ' -DHAVE_ECC '; then
+    echo 'skipping WOLFSSL_EXTERNAL_TEST because -UHAVE_ECC configuration of build is incompatible.'
+    exit 77
+fi
+
+echo "WOLFSSL_EXTERNAL_TEST set, running test..."
 
 # is our desired server there?
 "${SCRIPT_DIR}"/ping.test $server 2
diff --git a/scripts/google.test b/scripts/google.test
index e2b0c63d4..a2cb0388d 100755
--- a/scripts/google.test
+++ b/scripts/google.test
@@ -6,10 +6,20 @@ server=www.google.com
 
 [ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
 
-if ! test -n "$WOLFSSL_EXTERNAL_TEST"; then
+# These tests do not run by default, we will call these opt in. There are
+# additional default tests that require network connection, those are
+# opt out.
+# Not defining WOLFSSL_EXTERNAL_TEST runs only opt out.
+# Defining WOLFSSL_EXTERNAL_TEST!=0 runs opt out and opt in.
+# Defining WOLFSSL_EXTERNAL_TEST=0  does not run opt in or opt out.
+if [[ ! -v WOLFSSL_EXTERNAL_TEST ]]; then
     echo "WOLFSSL_EXTERNAL_TEST not set, won't run"
     exit 77
 fi
+if [[ "$WOLFSSL_EXTERNAL_TEST" == "0" ]]; then
+    echo "WOLFSSL_EXTERNAL_TEST is defined to zero, won't run"
+    exit 77
+fi
 
 if ! ./examples/client/client -V | grep -q 3; then
     echo 'skipping google.test because TLS1.2 is not available.' 1>&2
diff --git a/scripts/ocsp-stapling.test b/scripts/ocsp-stapling.test
index 226f7cd08..214916b6a 100755
--- a/scripts/ocsp-stapling.test
+++ b/scripts/ocsp-stapling.test
@@ -11,8 +11,15 @@ if [[ -z "${RETRIES_REMAINING-}" ]]; then
     export RETRIES_REMAINING=2
 fi
 
-if test -n "$WOLFSSL_NO_EXTERNAL_NETWORK_TESTS"; then
-    echo 'skipping oscp-stapling.test because WOLFSSL_NO_EXTERNAL_NETWORK_TESTS defined.'
+# These tests do run by default, we will call these opt out. There are
+# additional non-default tests that require network connection, those are
+# opt in.
+# Not defining WOLFSSL_EXTERNAL_TEST runs only opt out.
+# Defining WOLFSSL_EXTERNAL_TEST!=0 runs opt out and opt in.
+# Defining WOLFSSL_EXTERNAL_TEST=0  does not run opt in or opt out.
+if [[ "$WOLFSSL_EXTERNAL_TEST" == "0" ]]; then
+    echo 'skipping oscp-stapling.test because WOLFSSL_EXTERNAL_TEST is \
+    defined to the value 0.'
     exit 77
 fi