It's time for another housekeeping release of IPFire. We have been working behind the scenes on a lot of exciting things that we will roll out with the upcoming releases, but until then, we will still give you a healthy dose of updates throughout the entire operating system and we will fix a bug in the recently released migration to Knot Resolver.
Knot Resolver
In the last release, we migrated from Unbound to Knot Resolver for networks protected by IPFire. We have received wonderful feedback from you that DNS resolution is snappier and that some long-standing bugs are gone. However, we introduced a regression that left clients connected via IPsec, WireGuard or OpenVPN unable to resolve names, because Knot Resolver replied from the wrong source IP address. This required some larger changes to the I/O layer of Knot Resolver which we have contributed upstream.
Misc.
- Intrusion Prevention System: We have added Julio Lira's "Advanced Phishing Protection" ruleset to be used with the IPFire Intrusion Prevention System
- Kernel: We have rebased the IPFire kernel on Linux 6.18.54 which includes various fixes from the upstream maintainers for better stability and security
- WireGuard: Configuration files with multiple subnets that are separated with a space can now be imported properly (#13951)
- RISC-V: The experimental builds are now tuned for out-of-order cores. They stay compatible with the RVA22 baseline while taking advantage of the improvements in RVA23.
- Updated packages: acl 2.4.0, attr 2.6.0, Apache 2.4.68, bash 5.3p15, BIND 9.20.24, c-ares 1.34.8, cURL 8.21.0, elinks 0.19.1, ethtool 7.1, expat 2.8.2, file 5.48, glib 2.88.2, harfbuzz 14.2.1, hwdata 0.409, json-c 0.19, kbd 2.10.0, Knot 3.5.6, Knot Resolver 6.4.2, less 704, libarchive 3.8.8, libjpeg 3.2.0, lsof 4.99.7, OpenSSH 10.4p1, OpenSSL 3.6.5, pango 1.58.0, perl 5.42.2, perl-Net-DNS 1.55, protobuf 35.1, SQLite 3.53.3, sysstat 12.7.9, systemd 261.1, tzdata 2026c, vim 9.2.0769, wireless-regdb 2026.05.30
Add-Ons
- Observium Agent is now able to report the status of the Apache web server
- Zabbix now reports metrics for Knot Resolver
- Avahi: Shutdown could hang if the daemon wasn't running, because the resulting error wasn't handled
- Updated packages: alsa 1.2.16, clamav 1.5.3, dnsdist 2.1.0, fetchmail 6.6.6, ffmpeg 8.1.2, Git 2.55.0, HAProxy 3.4.2, ltrace 0.8.1, monit 6.0.0, nano 9.1, netsnmpd 5.9.5.2, Postfix 3.11.4, rsync 3.5.0, strace 7.1, stunnel 5.78, tmux 3.7b, transmission 4.1.3, tshark 4.6.7
We have a lot more in the pipeline. Monitoring and reporting are getting a serious upgrade, giving you a much clearer view of what your firewall is doing and how your network is behaving. We will share more soon.
In the meantime, please give this test release a try and let us know how it goes. If you connect via IPsec, WireGuard or OpenVPN, please check that name resolution works as expected. Bug reports are welcome on our bug tracker, and you can also join the discussion on the community forum.
More...
