IPFire protects networks all over the world, from home offices in Brazil to schools in Romania and companies in Japan. But until now, the people who look after those networks have mostly had to do it in English or in one of a handful of other languages. Core Update 205 changes that. It is now easier than ever for anyone to bring IPFire into their own language, and we would love for you to be part of it.
As always, this update also comes with a big pile of security fixes and package updates. Please help us test it!
Help IPFire speak your language
Behind the scenes, we have rebuilt how the web user interface is translated. The old home-grown system is gone and IPFire now uses GNU gettext, the same standard that most open source software uses. Along the way, we went through every single message: sentences that used to be glued together in code are now whole sentences, labels are written consistently, and common terms are spelled the same everywhere. That sounds small, but it makes a huge difference for translators, because they can finally translate meaning and not fragments.
All translations are now done on our own Weblate instance at translate.ipfire.org. You don't need to be a developer, you don't need to know Git, and you don't need to set anything up. Just open the page in your browser, pick your language and start translating. Even fixing a single string helps.
And people have already started: within the first few weeks, translations have come in for Croatian, Danish, Dutch, French, German, Hungarian, Italian, Japanese, Persian, Polish, Portuguese (Brazil), Romanian, Russian, Spanish, Swedish and Turkish. Thank you to everyone who has already jumped in!
We, as developers, can't do this alone. A firewall is only as good as the person running it, and that person should be able to understand every setting and every warning in their own language. If you speak a language that is missing or incomplete, this is your chance to make a real difference for administrators in your country.
Changes in the installer
- The installer now offers Hungarian, Romanian and Swedish
- Portuguese has been replaced by Brazilian Portuguese, which is far more complete
- Languages with next to no translation have been removed from the installer for now. They will come back as soon as they have been translated on Weblate.
- The console now uses a font that can display all letters of the Romanian alphabet
- The installer image has become smaller, because it is compressed with zstd and no longer ships graphics drivers that it doesn't use
Security
- Two command injection vulnerabilities have been fixed in the WIO add-on, which allowed an attacker to run shell commands as the user of the web server. We recommend that all users of WIO install this update as soon as possible.
- The web user interface no longer launches a shell to run commands, read files or find processes. This closes off a whole class of potential vulnerabilities.
- Root certificates that are known to be compromised have been removed from the system's certificate store
- The Intrusion Prevention System no longer inspects any ESP traffic, which is encrypted and cannot be inspected anyway
- Downloading the ThreatFox ruleset now requires an Auth-Key
- Outgoing network access for the DNS resolver has been restricted to DNS-related ports
Misc.
- strongSwan has been updated to 6.1.0, which no longer comes with the gcrypt plugin
- The system now uses dracut instead of dracut-ng to build its initial ramdisk
- GRUB is again using the UUID to find root file systems on software RAID
- The location database tool now correctly reports when the database is already up to date
- The IPS Reporter now uses the correct cron file
- IPFire now builds for loongarch64. You can read all about it in our recent blog post Yes, another architecture: IPFire now builds for LoongArch.
Updated packages: abseil-cpp 20260817.0, aprutil 1.6.5, automake 1.19, bash 5.3p20, BIND 9.20.29, binutils 2.46.1, Boost 1.92.0, btrfs-progs 7.1, ca-certificates 20260909, cairo 1.18.6, CMake 4.4.3, coreutils 9.12, cURL 8.22.0, ddns 015, dhcpcd 10.5.2, dracut 112, elfutils 0.196, expat 2.9.0, findutils 4.11.0, fontconfig 2.18.3, fribidi 1.0.17, fuse 3.18.3, GCC 16.1.0, GDB 18.1, glib 2.89.3, glibc 2.44, GRUB 2.16, gzip 1.15, harfbuzz 14.5.1, hwdata 0.411, iana-etc 20260911, intel-microcode 20260925, iproute2 7.2.0, jansson 2.15.1, Knot 3.6.0, less 710, libarchive 3.8.9, libcap-ng 0.9.6, libffi 3.8.0, libgcrypt 1.12.4, libksba 1.8.1, libpcap 1.11.0, libpng 1.6.59, libtirpc 1.3.8, libtool 2.6.2, liburcu 0.15.7, libxml2 2.15.4, lldpd 1.0.22, LMDB 1.0.2, logwatch 7.15, LVM2 2.03.43, meson 1.12.1, nano 9.2, ntfs-3g 2026.9.28, OpenLDAP 2.7.1, OpenSSH 10.5p1, OpenSSL 3.6.5, OpenVPN 2.7.7, p11-kit 0.26.5, PAM 1.7.3, pango 1.58.2, parted 3.8, PCRE2 10.49, perl-Net-DNS 1.57, pixman 0.46.4, procps 4.0.7, protobuf 36.1, readline 8.3p6, RRDtool 1.11.0, shadow 4.20.0, SQLite 3.53.4, strongSwan 6.1.0, Suricata 8.0.8, systemd 261.3, tzdata 2026e, util-linux 2.42.4, vim 9.2.1132, wpa_supplicant 2.12, xfsprogs 7.2.0, xorriso 1.5.8.pl02, xz 5.8.4, zone-sync 0.0.3
Add-Ons
- New: python3-zabbix-utils 2.0.4
- The Zabbix agent can now also collect metrics from Suricata
- alac has been removed, as it is no longer required by shairport-sync
Updated packages: Bacula 15.0.3, BIRD 3.3.3, BorgBackup 1.4.5, cifs-utils 7.8, clamav 1.5.4, dnsdist 2.1.2, faad2 2.11.3, fetchmail 6.6.9, ffmpeg 9.0.1, FLAC 1.5.0, flashrom 1.8.0, FORT Validator 1.6.8, FreeRADIUS 3.2.10, FRR 10.7.1, Git 2.56.0, HAProxy 3.4.3, htop 3.5.3, iperf3 3.22, keepalived 2.4.3, LAME 4.0, libmicrohttpd 1.0.10, libtalloc 2.5.0, libxxhash 0.8.4, nfs-utils 3.1.1, NUT 2.8.5, Postfix 3.11.7, python3-msgpack 1.2.1, rpcbind 1.3.1, rsync 3.5.1, Samba 4.25.0, SDL2 2.32.10, shairport-sync 5.5.2, swtpm 0.10.2, TagLib 2.3.1, tcpdump 4.99.6, tmux 3.7c, tshark 4.6.9, Zabbix Agent 7.0.29 (LTS)
Get involved
Please give this update a try on a test system and let us know how it goes on the IPFire Community. If you find a bug, please report it in our Bugzilla.
And if you have a few minutes to spare, head over to translate.ipfire.org and help make IPFire feel at home in your language. Every string counts.
IPFire is built by a small team and a big community, and it is our sponsors who make it possible for us to keep working on it. If IPFire protects your network at home or in your business, please consider becoming a sponsor. Every sponsor helps us spend more time on making IPFire better, and keeps it free and open for everyone.
More...
