IPFire, a Linux-based open-source firewall distribution designed for network security, routing, VPN, intrusion prevention, and related gateway tasks, has issued IPFire 2.29 Core Update 203, which replaces the firewall distribution’s long-standing Unbound DNS resolver with Knot Resolver.
According to the IPFire team, Unbound has served the project well for many years, but Knot Resolver provides a more flexible, modular, and scriptable foundation that can be integrated more closely with the rest of the system. The change enables several new DNS capabilities, including encrypted upstream forwarding over DNS-over-TLS.
The release also includes a new DNS Firewall that can block malware, advertising, and entire categories of unwanted domains at the DNS level. Its filtering and policy zones are downloaded through an encrypted connection using zone-sync, a new utility written in C by the IPFire developers.
SafeSearch enforcement is another addition, allowing administrators to enable protected search results across major search engines and YouTube for every device on the network. Core Update 203 also supports conditional forwarding, custom DNS records for local hostnames, and integration with DHCP leases.
On top of that, Knot Resolver now uses a persistent cache that survives restarts. Multiple resolver workers also share the same cache and state, allowing IPFire to use multiple CPU cores without splitting cached information between separate processes.
Importantly, administrators using DNS forwarding should note an important compatibility change. Forwarded zones can no longer point to fully qualified domain names, so any such entries must be replaced with IP addresses after the update.
Another important improvement is support for operating an IPFire wireless access point on the 6 GHz band used by Wi-Fi 6E and Wi-Fi 7 hardware. The additional spectrum provides more room for wide 80 MHz and 160 MHz channels, with less interference from older wireless devices.
For deployments on Amazon Web Services, IPFire can now retrieve EC2 instance metadata through IMDSv2. The older IMDSv1 protocol remains supported for existing systems.
Core Update 203 additionally includes updated Intel processor microcode addressing INTEL-SA-01420, a fix for Perl UTF-8 handling in the web interface, OpenVPN interface improvements, and restored localhost listening in sysklogd.
Finally, many packages have been refreshed, including BIND 9.20.23, Boost 1.90, coreutils 9.11, GRUB 2.14, OpenVPN 2.7.4, strongSwan 6.0.7, Suricata 8.0.6, SQLite 3.53.1, and util-linux 2.42. Updated add-ons include dnsdist 2.0.6, Postfix 3.11.3, Samba 4.24.2, rsync 3.4.3, and tmux 3.6b.
For additional details, see the announcement.
IPFire 2.29 Core Update 203 is available for download on IPFire’s website. Two build flavors cover the most common hardware: x86_64 and aarch64 for those needing a fresh install. Existing systems can be upgraded via IPFire’s web UI or the pakfire update command.
