The IPFire project has released Core Update 204 for version 2.29 of its open-source Linux-based firewall distribution.
The most important change concerns Knot Resolver, which replaced Unbound as IPFire’s DNS resolver in the previous update. According to the developers, the transition has generally been well received, with users reporting faster DNS resolution and fixes for several long-standing problems.
However, it introduced an unexpected issue affecting clients connected through IPsec, WireGuard, and OpenVPN. Specifically, Knot Resolver sent DNS responses from the wrong source IP address, preventing affected VPN clients from resolving domain names. Core Update 204 fixes this regression and restores proper DNS resolution for VPN connections.
Moreover, IPFire’s kernel has been rebased on Linux 6.18.54, incorporating upstream fixes to improve system stability and security. WireGuard users also get a smaller correction: previously, importing configuration files with multiple space-separated subnets could fail. These configurations can now be imported correctly.
As for package updates, the list is quite extensive. Among the notable upgrades are Apache 2.4.68, Bash 5.3p15, BIND 9.20.24, cURL 8.21, Knot Resolver 6.4.2, OpenSSH 10.4p1, OpenSSL 3.6.5, SQLite 3.53.3, and systemd 261.1.
Finally, several IPFire add-ons have been improved. Observium Agent can now report Apache web server status, and Zabbix supports collecting metrics from Knot Resolver. Additionally, an Avahi issue that could cause shutdown to hang when its daemon was not running has been fixed.
Updated add-on packages include ClamAV 1.5.3, FFmpeg 8.1.2, Git 2.55, HAProxy 3.4.2, Postfix 3.11.4, rsync 3.5, and Transmission 4.1.3, among others.
Finally, the developers shared a brief preview of what’s coming next. Future IPFire releases are expected to introduce significant improvements to monitoring and reporting, with no specific release date announced yet.
For more information, see the official announcement. IPFire 2.29 Core Update 204 is available for download from the project’s website.
