IPFire 2.29 Core Update 204 Fixes VPN DNS Issues and Updates Linux Kernel
The latest IPFire maintenance release corrects a DNS regression affecting VPN clients, moves the firewall kernel to Linux 6.18.54 and refreshes a wide range of system and add-on packages.
IPFire 2.29 Core Update 204 is a maintenance-focused release for the open-source Linux firewall distribution. Its most important change addresses a regression introduced during the migration from Unbound to Knot Resolver. The issue affected clients connected through IPsec, WireGuard and OpenVPN, which could no longer resolve domain names because DNS replies were sent from an incorrect source IP address.
What Is IPFire?
IPFire is an open-source Linux-based firewall distribution designed to protect networks and provide services such as routing, VPN connectivity, DNS, intrusion prevention and network security. It can be deployed on physical hardware, virtual machines and supported cloud platforms.
Core Updates are maintenance releases that refresh the operating system, fix bugs and update packages. Core Update 204 is particularly relevant to administrators using VPN tunnels to connect remote users, branch offices or other protected networks.
Knot Resolver Fixes DNS Resolution for VPN Clients
The headline change in Core Update 204 concerns Knot Resolver, which replaced Unbound in the preceding IPFire release. The migration had delivered faster DNS resolution and addressed several long-standing issues, but it also introduced a regression for VPN-connected clients.
What was the problem?
Clients connected through IPsec, WireGuard or OpenVPN could fail to resolve domain names. The reason was not simply that the DNS service was unavailable: Knot Resolver was replying from the wrong source IP address. That source-address mismatch prevented affected VPN clients from receiving usable DNS responses.
What has changed in Core Update 204?
The IPFire developers modified the I/O layer of Knot Resolver to correct the source-address behaviour. The project says the required changes were substantial and have also been contributed upstream.
Correct DNS response source
The resolver now addresses the incorrect source-IP behaviour that caused name resolution failures for affected VPN clients.
Three VPN technologies affected
The fix is relevant to clients using IPsec, WireGuard and OpenVPN connections to networks protected by IPFire.
Linux Kernel Updated to Version 6.18.54
IPFire’s kernel has been rebased on Linux 6.18.54. According to the release announcement, this brings fixes from upstream maintainers intended to improve stability and security.
The kernel is a critical part of a firewall appliance. It handles hardware interaction, network interfaces, packet processing and many of the low-level operations on which routing and security services depend. Keeping it current helps IPFire incorporate relevant upstream maintenance work.
The release announcement does not enumerate individual kernel CVEs or describe a specific performance improvement, so administrators should consult the official release information and upstream kernel advisories for detailed vulnerability and change tracking.
WireGuard Configuration Import Fix
Core Update 204 also corrects a WireGuard configuration-import problem. Configuration files containing multiple subnets separated by spaces can now be imported properly.
This is a targeted usability fix for administrators who import peer configurations with more than one allowed subnet. It does not represent a new WireGuard protocol feature; it fixes how this configuration format is handled during import.
Intrusion Prevention and Important Package Updates
Advanced Phishing Protection ruleset
IPFire’s Intrusion Prevention System (IPS) now offers Julio Lira’s Advanced Phishing Protection ruleset as a ruleset provider. This gives administrators another ruleset option for strengthening detection against phishing-related threats. As with any IPS ruleset, review its coverage, update cadence and potential false positives before enabling it broadly.
Selected base-system package updates
| Package | Updated version | Role |
|---|---|---|
| Apache | 2.4.68 | Web server |
| Bash | 5.3p15 | Command-line shell |
| BIND | 9.20.24 | DNS software |
| cURL | 8.21.0 | Data transfer utility and library |
| Knot Resolver | 6.4.2 | DNS resolver |
| OpenSSH | 10.4p1 | Secure remote access |
| OpenSSL | 3.6.5 | TLS and cryptographic library |
| SQLite | 3.53.3 | Embedded database engine |
| systemd | 261.1 | System and service manager |
The release also updates a broad collection of other packages, including acl, attr, c-ares, elinks, ethtool, expat, glib, harfbuzz, hwdata, json-c, kbd, less, libarchive, libjpeg, lsof, pango, Perl, protobuf, sysstat, tzdata and Vim. Refer to the official release notes for the complete version list.
Add-on Improvements
Core Update 204 includes changes to several IPFire add-ons in addition to the base operating system.
Observium Agent
The Observium Agent can now report the status of the Apache web server, extending the service information available to Observium monitoring.
Zabbix
Zabbix now reports metrics for Knot Resolver, improving monitoring visibility into the DNS resolver service.
Avahi
A shutdown hang has been fixed. It could occur when the Avahi daemon was not running and the resulting error was not handled.
Updated add-on packages
Updates include ClamAV 1.5.3, FFmpeg 8.1.2, Git 2.55.0, HAProxy 3.4.2, Postfix 3.11.4, rsync 3.5.0 and Transmission 4.1.3, among others.
RISC-V Experimental Build Improvements
The experimental RISC-V builds have been tuned for out-of-order cores. The project says they remain compatible with the RVA22 baseline while taking advantage of improvements available in RVA23. This is a platform-specific adjustment and does not change the stated baseline compatibility of those experimental builds.
How to Get IPFire 2.29 Core Update 204
IPFire 2.29 Core Update 204 is available from the project’s official download page. The project provides installation images for supported architectures and deployment types, including ISO and flash images, as well as cloud deployment options where available.
Read the Core Update 204 announcement and check whether the changes affect your VPN, DNS, monitoring or add-on configuration.
Before maintenance, ensure that you have a current backup of your IPFire configuration and a tested way to restore service if the update does not behave as expected.
Follow IPFire’s documented update procedure for your existing installation. For new deployments, select the correct ISO or flash image for the target architecture and hardware.
From clients connected over IPsec, WireGuard and OpenVPN, test both internal and external DNS names as appropriate for your network design.
Confirm that your IPS ruleset provider, Observium Agent, Zabbix integration and other installed add-ons are functioning as expected.
Download IPFire 2.29 Core Update 204 from the official website.
Final Thoughts
IPFire 2.29 Core Update 204 is primarily a maintenance and reliability release, but its VPN-related DNS correction is important for organizations that rely on remote-access or site-to-site tunnels. Restoring correct DNS responses for IPsec, WireGuard and OpenVPN clients addresses a real operational regression from the previous resolver migration.
The Linux 6.18.54 kernel rebase, WireGuard import correction, Advanced Phishing Protection ruleset and broad package refresh make this a worthwhile update for IPFire administrators. Plan the maintenance window, preserve a recoverable configuration backup and specifically test DNS from VPN-connected clients after applying the release.