https://n00bunlimited.net/ News Taken from the IPfire blog en Wed, 11 Nov 2026 03:19:20 GMT vBulletin 60 https://n00bunlimited.net/images/misc/rss.png https://n00bunlimited.net/ https://n00bunlimited.net/home/forum/site-news/ipfire/80504-ipfire-2-29-core-update-205-released Tue, 03 Nov 2026 11:22:10 GMT We are releasing IPFire 2.29 - Core Update 205 immediately as an emergency update. Please install it as soon as possible. Security fix This...
We are releasing IPFire 2.29 - Core Update 205 immediately as an emergency update. Please install it as soon as possible.

Security fix

This update fixes CVE-2026-98432, a serious use-after-free vulnerability in the Linux kernel's TCP stack. Because the flaw is in the network stack that every IPFire system relies on, we strongly recommend that you do not wait for your next maintenance window.

Other changes

Core Update 205 ships only a new Linux kernel, updated to 6.18.60. Besides the fix for CVE-2026-98432, it fixes a crash in the Broadcom network driver.

A reboot is required

Since the kernel is replaced, this update requires a reboot. The fixes only take effect after you have rebooted your system, so please do not skip this step.

You can install the update from the web user interface or with pakfire as usual.

What happened to the previous Core Update 205?

The changes that were previously planned for Core Update 205 have been moved to Core Update 206, which is now out for testing. Thank you to everyone who is helping to test it.

Please support IPFire

IPFire is free and open source, and it is maintained by a small team. Emergency releases like this one are only possible because people and companies keep the project going. If you rely on IPFire, please consider becoming a sponsor.

Thank you for using IPFire, and please update today.


More...]]> Ipfire siosios https://n00bunlimited.net/home/forum/site-news/ipfire/80504-ipfire-2-29-core-update-205-released https://n00bunlimited.net/home/forum/site-news/ipfire/80503-ipfire-2-29-core-update-205-is-available-for-testing Sat, 31 Oct 2026 11:23:12 GMT IPFire protects networks all over the world, from home offices in Brazil to schools in Romania and companies in Japan. But until now, the people who...
IPFire protects networks all over the world, from home offices in Brazil to schools in Romania and companies in Japan. But until now, the people who look after those networks have mostly had to do it in English or in one of a handful of other languages. Core Update 205 changes that. It is now easier than ever for anyone to bring IPFire into their own language, and we would love for you to be part of it.

As always, this update also comes with a big pile of security fixes and package updates. Please help us test it!

Help IPFire speak your language

Behind the scenes, we have rebuilt how the web user interface is translated. The old home-grown system is gone and IPFire now uses GNU gettext, the same standard that most open source software uses. Along the way, we went through every single message: sentences that used to be glued together in code are now whole sentences, labels are written consistently, and common terms are spelled the same everywhere. That sounds small, but it makes a huge difference for translators, because they can finally translate meaning and not fragments.

All translations are now done on our own Weblate instance at translate.ipfire.org. You don't need to be a developer, you don't need to know Git, and you don't need to set anything up. Just open the page in your browser, pick your language and start translating. Even fixing a single string helps.

And people have already started: within the first few weeks, translations have come in for Croatian, Danish, Dutch, French, German, Hungarian, Italian, Japanese, Persian, Polish, Portuguese (Brazil), Romanian, Russian, Spanish, Swedish and Turkish. Thank you to everyone who has already jumped in!

We, as developers, can't do this alone. A firewall is only as good as the person running it, and that person should be able to understand every setting and every warning in their own language. If you speak a language that is missing or incomplete, this is your chance to make a real difference for administrators in your country.

Changes in the installer

• The installer now offers Hungarian, Romanian and Swedish
• Portuguese has been replaced by Brazilian Portuguese, which is far more complete
• Languages with next to no translation have been removed from the installer for now. They will come back as soon as they have been translated on Weblate.
• The console now uses a font that can display all letters of the Romanian alphabet
• The installer image has become smaller, because it is compressed with zstd and no longer ships graphics drivers that it doesn't use

Security

• Two command injection vulnerabilities have been fixed in the WIO add-on, which allowed an attacker to run shell commands as the user of the web server. We recommend that all users of WIO install this update as soon as possible.
• The web user interface no longer launches a shell to run commands, read files or find processes. This closes off a whole class of potential vulnerabilities.
• Root certificates that are known to be compromised have been removed from the system's certificate store
• The Intrusion Prevention System no longer inspects any ESP traffic, which is encrypted and cannot be inspected anyway
• Downloading the ThreatFox ruleset now requires an Auth-Key
• Outgoing network access for the DNS resolver has been restricted to DNS-related ports

Misc.

• strongSwan has been updated to 6.1.0, which no longer comes with the gcrypt plugin
• The system now uses dracut instead of dracut-ng to build its initial ramdisk
• GRUB is again using the UUID to find root file systems on software RAID
• The location database tool now correctly reports when the database is already up to date
• The IPS Reporter now uses the correct cron file
• IPFire now builds for loongarch64. You can read all about it in our recent blog post Yes, another architecture: IPFire now builds for LoongArch.

Updated packages: abseil-cpp 20260817.0, aprutil 1.6.5, automake 1.19, bash 5.3p20, BIND 9.20.29, binutils 2.46.1, Boost 1.92.0, btrfs-progs 7.1, ca-certificates 20260909, cairo 1.18.6, CMake 4.4.3, coreutils 9.12, cURL 8.22.0, ddns 015, dhcpcd 10.5.2, dracut 112, elfutils 0.196, expat 2.9.0, findutils 4.11.0, fontconfig 2.18.3, fribidi 1.0.17, fuse 3.18.3, GCC 16.1.0, GDB 18.1, glib 2.89.3, glibc 2.44, GRUB 2.16, gzip 1.15, harfbuzz 14.5.1, hwdata 0.411, iana-etc 20260911, intel-microcode 20260925, iproute2 7.2.0, jansson 2.15.1, Knot 3.6.0, less 710, libarchive 3.8.9, libcap-ng 0.9.6, libffi 3.8.0, libgcrypt 1.12.4, libksba 1.8.1, libpcap 1.11.0, libpng 1.6.59, libtirpc 1.3.8, libtool 2.6.2, liburcu 0.15.7, libxml2 2.15.4, lldpd 1.0.22, LMDB 1.0.2, logwatch 7.15, LVM2 2.03.43, meson 1.12.1, nano 9.2, ntfs-3g 2026.9.28, OpenLDAP 2.7.1, OpenSSH 10.5p1, OpenSSL 3.6.5, OpenVPN 2.7.7, p11-kit 0.26.5, PAM 1.7.3, pango 1.58.2, parted 3.8, PCRE2 10.49, perl-Net-DNS 1.57, pixman 0.46.4, procps 4.0.7, protobuf 36.1, readline 8.3p6, RRDtool 1.11.0, shadow 4.20.0, SQLite 3.53.4, strongSwan 6.1.0, Suricata 8.0.8, systemd 261.3, tzdata 2026e, util-linux 2.42.4, vim 9.2.1132, wpa_supplicant 2.12, xfsprogs 7.2.0, xorriso 1.5.8.pl02, xz 5.8.4, zone-sync 0.0.3

Add-Ons

• New: python3-zabbix-utils 2.0.4
• The Zabbix agent can now also collect metrics from Suricata
• alac has been removed, as it is no longer required by shairport-sync

Updated packages: Bacula 15.0.3, BIRD 3.3.3, BorgBackup 1.4.5, cifs-utils 7.8, clamav 1.5.4, dnsdist 2.1.2, faad2 2.11.3, fetchmail 6.6.9, ffmpeg 9.0.1, FLAC 1.5.0, flashrom 1.8.0, FORT Validator 1.6.8, FreeRADIUS 3.2.10, FRR 10.7.1, Git 2.56.0, HAProxy 3.4.3, htop 3.5.3, iperf3 3.22, keepalived 2.4.3, LAME 4.0, libmicrohttpd 1.0.10, libtalloc 2.5.0, libxxhash 0.8.4, nfs-utils 3.1.1, NUT 2.8.5, Postfix 3.11.7, python3-msgpack 1.2.1, rpcbind 1.3.1, rsync 3.5.1, Samba 4.25.0, SDL2 2.32.10, shairport-sync 5.5.2, swtpm 0.10.2, TagLib 2.3.1, tcpdump 4.99.6, tmux 3.7c, tshark 4.6.9, Zabbix Agent 7.0.29 (LTS)

Get involved

Please give this update a try on a test system and let us know how it goes on the IPFire Community. If you find a bug, please report it in our Bugzilla.

And if you have a few minutes to spare, head over to translate.ipfire.org and help make IPFire feel at home in your language. Every string counts.

IPFire is built by a small team and a big community, and it is our sponsors who make it possible for us to keep working on it. If IPFire protects your network at home or in your business, please consider becoming a sponsor. Every sponsor helps us spend more time on making IPFire better, and keeps it free and open for everyone.


More...]]> Ipfire siosios https://n00bunlimited.net/home/forum/site-news/ipfire/80503-ipfire-2-29-core-update-205-is-available-for-testing https://n00bunlimited.net/home/forum/site-news/ipfire/80500-yes-another-architecture-ipfire-now-builds-for-loongarch Fri, 23 Oct 2026 09:13:44 GMT A few weeks ago we told you about RISC-V. Today: LoongArch. Another architecture, you ask? Yes. Grab a coffee, and let me tell you why. IPFire...
A few weeks ago we told you about RISC-V. Today: LoongArch.

Another architecture, you ask? Yes. Grab a coffee, and let me tell you why.

IPFire is now available for yet another architecture. LoongArch joins x86, ARM and RISC-V as the fourth 64-bit architecture we support, and the second one we have added this year. Somewhere a build server just sighed.

A Big Thank You

None of this would have happened without our friends at the Loongson Hobbyists' Community, who gifted us the build hardware. We are an open-source project, and nobody was obliged to hand us a very nice computer. They did anyway, and it arrived super fast and completely uncomplicated, directly from China.

A porting project lives or dies by having real hardware to work on, and they gave us exactly that. Thank you, truly.

Meet the Machine

The machine is built around a Loongson 3A6000-HV processor on a Loongson XA61200 motherboard, and it is now the fastest machine in our build farm. It completes a full build of IPFire in just over two hours. For comparison, our RISC-V builds take about seven hours on a real board, and used to take 54 to 56 hours under emulation, which is the kind of number that makes you question your career choices.

This is no surprise. It is not yet another SBC, but a properly sized DTX board with a beefy processor and a big fan. It looks like a machine that came to work.

I have to be upfront about one thing: it lives in a data centre as a build system, so I have not been able to boot IPFire on it yet. In an emulated virtual machine, it boots just fine. Yes, I know, "it works in the VM" is the hardware equivalent of "it works on my machine". But it is a real milestone: the toolchain works, the packages build, and the result starts and runs.

But Why?

A milestone? With no hardware to run it on? I know what you are thinking: we are porting to a CPU that you cannot buy at your local shop. What is the point?

There are several good reasons.

It proves that our build is clean: Every new architecture is a stress test. If IPFire builds and runs on four of them, our toolchain and build system clearly do not depend on the quirks of one host architecture. That is also a security feature. If IPFire can be rebuilt independently on different machines, audits get easier and bugs get easier to reproduce.

It gives you choice: We want to be the opposite of vendor lock-in. When IPFire runs on x86, ARM, RISC-V and LoongArch, you are not tied to Intel, AMD or any single vendor's roadmap. You pick the hardware on your terms: best price, best availability, or the roadmap you trust. Researchers, governments and operators of critical infrastructure are actively looking to avoid depending on a single, dominant instruction set, and they deserve a good firewall, too.

It was the easiest port yet: Partly because we learned a lot from the earlier ones. Partly because LoongArch did its homework: support is upstream in the Linux kernel, GCC and the rest of the toolchain, and pretty much everywhere else it needs to be. This is not an architecture in its early days. It has arrived.

And no, we are not the only lunatics doing this. Debian is about to become available for LoongArch, too, so we are in good company.

Even if you never run LoongArch, you benefit. A resilient build and better-tested software make a better firewall on every architecture, including the one behind your shoe rack right now.

What's Next

Our goal is to grow IPFire's user base on non-x86 hardware. The software is here, so now we wait for the hardware to catch up. If you are a vendor building LoongArch, RISC-V or ARM hardware and would like to work with us, we would be happy to hear from you.

If you want to try it yourself, nightly images are available, and packages work as usual. Tell us what you find, and ask any questions, on the development mailing list.


More...]]> Ipfire siosios https://n00bunlimited.net/home/forum/site-news/ipfire/80500-yes-another-architecture-ipfire-now-builds-for-loongarch https://n00bunlimited.net/home/forum/site-news/ipfire/80498-ipfire-2-29-core-update-204-released Wed, 14 Oct 2026 10:00:26 GMT IPFire 2.29 - Core Update 204 is now available for download. It is a housekeeping release that brings a healthy dose of updates across the entire...
IPFire 2.29 - Core Update 204 is now available for download. It is a housekeeping release that brings a healthy dose of updates across the entire operating system and fixes a regression in our recent migration to Knot Resolver. Behind the scenes, we have been busy with some exciting things, and you will see the first of them in upcoming releases.

Knot Resolver

In the last release, we migrated from Unbound to Knot Resolver for networks protected by IPFire. We have received very positive feedback that DNS resolution is noticeably faster and that some long-standing issues have been resolved. However, the migration introduced a regression: clients connected via IPsec, WireGuard or OpenVPN were unable to resolve names, because Knot Resolver replied from the wrong source IP address. This release fixes the issue. Doing so required substantial changes to the I/O layer of Knot Resolver, which we have contributed upstream.

Miscellaneous

• Intrusion Prevention System: Julio Lira's "Advanced Phishing Protection" ruleset is now available as a ruleset provider.
• Kernel: The IPFire kernel has been rebased on Linux 6.18.54, which includes various fixes from the upstream maintainers for improved stability and security.
• WireGuard: Configuration files with multiple space-separated subnets can now be imported correctly (#13951).
• RISC-V: The experimental builds are now tuned for out-of-order cores. They remain compatible with the RVA22 baseline while taking advantage of the improvements in RVA23.
• Updated packages: acl 2.4.0, attr 2.6.0, Apache 2.4.68, bash 5.3p15, BIND 9.20.24, c-ares 1.34.8, cURL 8.21.0, elinks 0.19.1, ethtool 7.1, expat 2.8.2, file 5.48, glib 2.88.2, harfbuzz 14.2.1, hwdata 0.409, json-c 0.19, kbd 2.10.0, Knot 3.5.6, Knot Resolver 6.4.2, less 704, libarchive 3.8.8, libjpeg 3.2.0, lsof 4.99.7, OpenSSH 10.4p1, OpenSSL 3.6.5, pango 1.58.0, perl 5.42.2, perl-Net-DNS 1.55, protobuf 35.1, SQLite 3.53.3, sysstat 12.7.9, systemd 261.1, tzdata 2026c, vim 9.2.0769, wireless-regdb 2026.05.30

Add-Ons

• Observium Agent can now report the status of the Apache web server.
• Zabbix now reports metrics for Knot Resolver.
• Avahi: Fixed a hang during shutdown when the daemon was not running, caused by an unhandled error.
• Updated packages: ALSA 1.2.16, ClamAV 1.5.3, dnsdist 2.1.0, fetchmail 6.6.6, FFmpeg 8.1.2, Git 2.55.0, HAProxy 3.4.2, ltrace 0.8.1, monit 6.0.0, nano 9.1, netsnmpd 5.9.5.2, Postfix 3.11.4, rsync 3.5.0, strace 7.1, stunnel 5.78, tmux 3.7b, transmission 4.1.3, tshark 4.6.7

---

There is a lot more on the way. Monitoring and reporting are getting a serious upgrade that will give you a much clearer picture of what your firewall is doing and how your network is behaving. We will share more about this very soon.

A big thank you to everyone who tested this release and sent us feedback. Your reports, especially from users connecting via IPsec, WireGuard and OpenVPN, helped us make sure the Knot Resolver fix works as intended.

IPFire is built by a small team and a dedicated community. If IPFire protects your network, please consider becoming a sponsor and helping us keep the project independent and moving forward.


More...]]> Ipfire siosios https://n00bunlimited.net/home/forum/site-news/ipfire/80498-ipfire-2-29-core-update-204-released https://n00bunlimited.net/home/forum/site-news/ipfire/80494-ipfire-2-29-core-update-204-is-available-for-testing Fri, 02 Oct 2026 09:10:23 GMT
It's time for another housekeeping release of IPFire. We have been working behind the scenes on a lot of exciting things that we will roll out with the upcoming releases, but until then, we will still give you a healthy dose of updates throughout the entire operating system and we will fix a bug in the recently released migration to Knot Resolver.

Knot Resolver

In the last release, we migrated from Unbound to Knot Resolver for networks protected by IPFire. We have received wonderful feedback from you that DNS resolution is snappier and that some long-standing bugs are gone. However, we introduced a regression that left clients connected via IPsec, WireGuard or OpenVPN unable to resolve names, because Knot Resolver replied from the wrong source IP address. This required some larger changes to the I/O layer of Knot Resolver which we have contributed upstream.

Misc.

• Intrusion Prevention System: We have added Julio Lira's "Advanced Phishing Protection" ruleset to be used with the IPFire Intrusion Prevention System
• Kernel: We have rebased the IPFire kernel on Linux 6.18.54 which includes various fixes from the upstream maintainers for better stability and security
• WireGuard: Configuration files with multiple subnets that are separated with a space can now be imported properly (#13951)
• RISC-V: The experimental builds are now tuned for out-of-order cores. They stay compatible with the RVA22 baseline while taking advantage of the improvements in RVA23.
• Updated packages: acl 2.4.0, attr 2.6.0, Apache 2.4.68, bash 5.3p15, BIND 9.20.24, c-ares 1.34.8, cURL 8.21.0, elinks 0.19.1, ethtool 7.1, expat 2.8.2, file 5.48, glib 2.88.2, harfbuzz 14.2.1, hwdata 0.409, json-c 0.19, kbd 2.10.0, Knot 3.5.6, Knot Resolver 6.4.2, less 704, libarchive 3.8.8, libjpeg 3.2.0, lsof 4.99.7, OpenSSH 10.4p1, OpenSSL 3.6.5, pango 1.58.0, perl 5.42.2, perl-Net-DNS 1.55, protobuf 35.1, SQLite 3.53.3, sysstat 12.7.9, systemd 261.1, tzdata 2026c, vim 9.2.0769, wireless-regdb 2026.05.30

Add-Ons

• Observium Agent is now able to report the status of the Apache web server
• Zabbix now reports metrics for Knot Resolver
• Avahi: Shutdown could hang if the daemon wasn't running, because the resulting error wasn't handled
• Updated packages: alsa 1.2.16, clamav 1.5.3, dnsdist 2.1.0, fetchmail 6.6.6, ffmpeg 8.1.2, Git 2.55.0, HAProxy 3.4.2, ltrace 0.8.1, monit 6.0.0, nano 9.1, netsnmpd 5.9.5.2, Postfix 3.11.4, rsync 3.5.0, strace 7.1, stunnel 5.78, tmux 3.7b, transmission 4.1.3, tshark 4.6.7

---

We have a lot more in the pipeline. Monitoring and reporting are getting a serious upgrade, giving you a much clearer view of what your firewall is doing and how your network is behaving. We will share more soon.

In the meantime, please give this test release a try and let us know how it goes. If you connect via IPsec, WireGuard or OpenVPN, please check that name resolution works as expected. Bug reports are welcome on our bug tracker, and you can also join the discussion on the community forum.


More...]]> Ipfire siosios https://n00bunlimited.net/home/forum/site-news/ipfire/80494-ipfire-2-29-core-update-204-is-available-for-testing https://n00bunlimited.net/home/forum/site-news/ipfire/80492-ipfire-walk-through-and-review Mon, 07 Sep 2026 14:54:13 GMT ]]> Ipfire siosios https://n00bunlimited.net/home/forum/site-news/ipfire/80492-ipfire-walk-through-and-review