Linux Firewall · Network Security · Release News
IPFire 2.29 Core Update 204 Fixes VPN DNS Issues and Updates Linux Kernel
IPFire 2.29 Core Update 204 fixes a DNS regression affecting VPN-connected clients, rebases the firewall kernel on Linux 6.18.54, and refreshes important system and add-on packages. Here is what network administrators should know before updating.
What is IPFire?
IPFire is an open-source, Linux-based firewall distribution designed to protect networks and provide routing, filtering, VPN connectivity, and additional network services. It can run on dedicated appliances or supported x86_64 and ARM hardware, making it relevant to small offices, labs, and enterprise network-edge deployments.
IPFire 2.29 Core Update 204 was announced on October 14, 2026. The project describes it as a housekeeping release with operating-system updates and a fix for a regression introduced during the migration from Unbound to Knot Resolver.
VPN DNS fix
Corrects the resolver source-address behavior affecting DNS queries from IPsec, WireGuard, and OpenVPN clients.
Linux kernel 6.18.54
Rebases the IPFire kernel on a newer upstream release containing stability and security fixes.
WireGuard import fix
Configuration files with multiple space-separated subnets can now be imported correctly.
Monitoring improvements
Observium Agent can report Apache status, and Zabbix can collect Knot Resolver metrics.
Fixes DNS resolution for VPN clients
The previous IPFire release moved protected networks from Unbound to Knot Resolver. The project reported positive feedback on DNS speed and fixes for older issues, but the transition also introduced a regression for VPN-connected clients.
Knot Resolver replied from the wrong source IP address. As a result, clients connected through IPsec, WireGuard, or OpenVPN could be unable to resolve domain names even when the VPN connection itself appeared to be up. Core Update 204 fixes this behavior through changes to Knot Resolver’s I/O layer, which IPFire developers contributed upstream.
What administrators should verify
- Test name resolution from a client connected through each VPN type used in your environment.
- Check both internal DNS zones and permitted external names.
- Confirm that clients can resolve names after reconnecting and after the firewall’s normal restart or maintenance process.
- Review resolver and VPN logs if a client can reach an IP address but cannot resolve its hostname.
These are recommended validation steps, not claims that VMoreCloud independently tested the update. The exact checks should match your network’s split-DNS, forwarding, and access-control design.
Linux kernel updated to 6.18.54
Core Update 204 rebases the IPFire kernel on Linux 6.18.54. The project says this brings upstream fixes intended to improve stability and security. Kernel updates are particularly relevant on firewall systems because the kernel handles networking, interfaces with hardware drivers, and forms a core part of the system’s attack surface.
The release notes do not attribute a single new user-facing firewall feature to the kernel update. Administrators should treat it as part of the broader maintenance and security update rather than assume a specific performance gain.
WireGuard configuration import fix
The update corrects an issue where WireGuard configuration files containing multiple subnets separated by spaces could fail to import properly. If you manage many peers or use generated configuration files, this change can reduce the need to edit affected files manually.
After updating, validate representative peer configurations and check allowed-address or subnet entries carefully. Do not assume a configuration imported successfully until the peer’s routes and connectivity behave as expected.
Important package updates
Core Update 204 refreshes a broad set of base-system packages. Notable versions listed by the IPFire project include:
| Package | Version | Why it matters |
|---|---|---|
| Apache | 2.4.68 | Web-server component used by services and management-related functions. |
| Bash | 5.3p15 | Shell used by scripts and administrative workflows. |
| BIND | 9.20.24 | DNS software package in the system’s broader package set. |
| cURL | 8.21.0 | Network transfer utility and library. |
| Knot Resolver | 6.4.2 | Resolver involved in the VPN DNS regression fix. |
| OpenSSH | 10.4p1 | Secure remote administration and transport tools. |
| OpenSSL | 3.6.5 | Cryptographic library used by software components. |
| SQLite | 3.53.3 | Embedded database library. |
| systemd | 261.1 | System and service-management components. |
The complete release includes additional package updates, including acl, attr, c-ares, expat, glib, harfbuzz, hwdata, json-c, kbd, libarchive, libjpeg, lsof, pango, Perl, protobuf, sysstat, tzdata, and vim. Refer to the official announcement for the complete list.
Intrusion prevention and add-on changes
Advanced Phishing Protection ruleset
The Intrusion Prevention System can now use Julio Lira’s Advanced Phishing Protection ruleset as a ruleset provider. Administrators should review the provider’s coverage, update cadence, and potential false positives before enabling new detection rules broadly.
Observium and Zabbix integration
Observium Agent can now report the status of the Apache web server. Zabbix can collect metrics from Knot Resolver, giving monitoring systems additional visibility into resolver behavior. These integrations can help operators build a clearer picture of the services running on an IPFire installation.
Avahi shutdown fix and updated add-ons
An Avahi issue that could cause a hang during shutdown when its daemon was not running has been fixed. Add-on packages are also refreshed, including ClamAV 1.5.3, FFmpeg 8.1.2, Git 2.55.0, HAProxy 3.4.2, Postfix 3.11.4, rsync 3.5.0, strace 7.1, tmux 3.7b, and Transmission 4.1.3.
RISC-V experimental build improvements
The experimental RISC-V builds are now tuned for out-of-order cores. According to the project, they remain compatible with the RVA22 baseline while taking advantage of improvements in RVA23. This is a platform-specific refinement and does not mean every RISC-V system is supported as a production-ready IPFire appliance.
Download IPFire 2.29 Core Update 204
Use IPFire’s official download and release infrastructure to obtain the correct image for your hardware architecture. The release directory lists x86_64 and AArch64 ISO and disk-image artifacts. Verify the architecture and installation method before writing an image to a device.
Read the official IPFire Core Update 204 announcement
Open the official IPFire release directory
For installed systems, follow the project’s supported update process and review any release-specific guidance. Back up the configuration and ensure you have a recovery route before updating a firewall that provides connectivity to other users.
Upgrade checklist for network administrators
- Back up the IPFire configuration and confirm you can restore it if the update fails.
- Schedule maintenance for a time when a brief network interruption is acceptable.
- Update using IPFire’s supported mechanism and check that the appliance returns to normal operation.
- Test DNS resolution from IPsec, WireGuard, and OpenVPN clients that exist in your environment.
- Check WireGuard peer imports if your configuration uses multiple space-separated subnets.
- Verify firewall rules, DNS forwarding, routing, and critical internet or internal-service access.
- Confirm monitoring continues to collect the expected metrics after the package updates.
What comes next?
The IPFire team has previewed upcoming improvements to monitoring and reporting, intended to provide a clearer picture of firewall activity and network behavior. The release announcement does not provide a specific delivery date, so administrators should treat these improvements as future work rather than features included in Core Update 204.
Official sources
- IPFire 2.29 Core Update 204 release announcement — authoritative list of changes and package versions.
- Official IPFire release directory — release artifacts and architecture-specific images.
- IPFire project website — project overview and documentation.
- Linuxiac release coverage — secondary reporting on the release.
