The wait is over! IPFire 2.29 - Core Update 197 has officially arrived! This is not just another update… At the heart of this release is a complete OpenVPN overhaul, now upgraded to version 2.6. That means stronger security, broader client compatibility, and a modernised codebase - all seamlessly integrated, with no changes required to your existing configurations. But that’s not all. We’ve fine-tuned system performance to let your CPU spend more time in power-saving states, cutting energy consumption while keeping your firewall lightning fast. And as always, this update delivers a huge round of package updates to keep your system secure, stable, and ready for anything.
Behind this milestone release stands a dedicated team of contributors who have poured countless hours into making Core Update 197 a reality. But innovation like this doesn’t happen on passion alone. Donations have been lower than usual, and we need your support to keep the momentum going. If IPFire protects your network, there’s no better moment to show your appreciation. Every contribution — big or small — goes directly to the development team, powering new features, faster performance, and stronger security for everyone.
Let’s keep the fire burning. Donate Now!
OpenVPN 2.6
After recently releasing full-fledged support for WireGuard to IPFire this update brings a substantial overhaul for OpenVPN. We are upgrading to OpenVPN 2.6 which has added some new features, but has deprecated a lot, too. The IPFire team has worked very hard to bring you these changes without requiring any configuration changes on the client side and we are still able to support older and newer OpenVPN clients
at the same time. Here is the list of notable changes:
- Simpler Client Configuration Export: The client configuration has now been unified and the ZIP container has been dropped. All certificate and key material is now embedded into a single configuration file which can be easily imported into all available clients.
- Cryptography
- OpenVPN will now perform cipher negotiation between the server and client if they support it
- Formerly, the cipher and hash algorithm were statically chosen and configured on both, the client and server side. This is still supported as "Fallback Cipher" for clients which don't support cipher negotiation. New installations will no longer offer a fallback and require cipher negotiation.
- SHA512 is chosen as the default hash method if no AEAD cipher is being used
- The cryptographic settings have been moved to the "Advanced Settings" section
- Compression
- OpenVPN has entirely removed support for compression as it can be used as an attack vector
- Clients that still try to use compression will be able to do so without any changes, but the server will try to disable compression wherever possible. It is no longer possible forcibly enable this.
- Subnet Topology: OpenVPN has removed support for the previously default way of IP address allocation where each client received a small subnet of four IP address. Instead a single IP address will now be used for each client. This frees all previously unusable IP addresses in the pools and quadruples their size.
- OpenVPN settings can now be changed without stopping the road warrior service first. When the server is being restarted, clients will be notified so that they will reconnect immediately.
- Descriptions, labels and headlines in the web UI have been clarified for a much easier configuration experience
- The code has been substantially cleaned up and largely refactored for better maintainability
- Where formerly the web UI only accepted the older subnet notation the CIDR notation is now supported, too
- The permanent certificate warning has been removed
Power Saving Or Keeping Cool In The Summer
IPFire will now by default clock down its CPUs. When previously all CPU cores have been running on full clock speed by default, we were able to keep latency to a minimum as they were always ready to process any packets. As modern processors have massively improved how quickly they can clock up and down and CPUs with many cores being widely available, we have now decided to change this based on our benchmark results.
Where supported, we will use Intel P-State or otherwise fall back to the new
schedutil governor which has recently been introduced into the Linux kernel and has proven to not increase any packet forwarding latency in our benchmarks.
When clocked down, systems will reduce their power consumption and therefore lowering the amount of emitted heat. The "cpufrequtil" package which used to implement this feature has been dropped as it is no longer needed.
Misc.
- WireGuard
- Configuration files using Windows line breaks can now be imported without manual conversion
- Any IPv6 routes in imported configurations are being ignored
- Intrusion Prevention System: The SSL fingerprint list from abuse.ch has been removed as it was discontinued
- Backup: It is now possible to restore backups that are larger than 2 GiB through the web UI
- A race condition which could cause that some network interfaces were not brought up properly at boot time has been fixed
- The IPFire kernel has been rebased on Linux 6.12.41
- New mitigations against Transient Scheduler Attacks have been added and the status is shown on the hardware vulnerabilities page
- Updated packages: Apache 2.4.65, automake 1.18.1, bash 5.3.3, bind 9.20.11, btrfs-progs 6.15, cURL 8.15.0, e2fsprogs 1.47.3, fontconfig 2.17.1, gettext 0.26, GnuTLS 3.8.10, jq 1.8.1, libhtp 0.5.51, libjpeg 3.1.1, libpng 1.6.50, libssh 0.11.2, libtalloc 2.4.3, libtasn1 4.20.0, libunistring: New package, lm_sensors 3.6.2, LVM2 2.03.33, nettle 3.10.2, OpenSSL 3.5.1, OpenVPN 2.6.14, pango 1.56.4, pciutils 3.14.0, readline 8.3.1, shadow 4.18.0, SQLite 3.50.2, strongSwan 6.0.2, Suricata 7.0.11, unbound 1.23.1, util-linux 2.41.1
- A Chinese translation has been added
Add-Ons
- New Packages:
- Daniel Weismüller has added tools that allow to emulate a TPM 2.0 device which is required to run virtual machines using Microsoft Windows 11 or later
- arpwatch has been added. This tool is able to send an email whenever a host is being detected on a local network interface for the first time.
- Robin Roevens has updated the Zabbix add-on to version 7.0.16 LTS
- Additionally he has added monitoring for WireGuard connections, ARP ping support for the internet gateway and IPFire Location functionality
- Borg Backup: The libxxhash package which is required as a dependency is now automatically installed (#13868)
- Updated packages: cifs-utils 7.4, dnsdist 2.0.0, FreeRADIUS 3.2.7, Git 2.50.1, HAProxy 3.2.2, ncdu 1.22, taglib 2.1.1, tshark 4.4.8, Samba 4.22.3
forum.netgate.com
www.ipfire.org
