IPFire 2.29 - Core Update 204 released

Key points

IPFire 2.29 Core Update 204 is out as a maintenance release that updates packages throughout the system. It also fixes a DNS regression from the previous update's move to Knot Resolver, which left VPN clients unable to resolve names.

Knot Resolver fix

• The previous Core Update replaced Unbound with Knot Resolver as the DNS resolver for networks behind IPFire.
• After that switch, clients connected through IPsec, WireGuard or OpenVPN could not resolve names, because Knot Resolver sent its answers from the wrong source IP address.
• This update corrects the problem. The fix needed major changes to Knot Resolver's I/O layer, and the project has submitted those changes upstream.
• Users connecting over IPsec, WireGuard and OpenVPN tested the fix before release.

System changes

• Kernel: rebased on Linux 6.18.54, which brings upstream stability and security fixes.
• Intrusion Prevention System: Julio Lira's "Advanced Phishing Protection" ruleset can now be chosen as a ruleset provider.
• WireGuard: configuration files that list several subnets separated by spaces now import correctly (#13951).
• RISC-V (experimental builds): now optimised for out-of-order cores. They still work on the RVA22 baseline and take advantage of RVA23 improvements.

Updated core packages

• acl 2.4.0, attr 2.6.0, Apache 2.4.68, bash 5.3p15, BIND 9.20.24, c-ares 1.34.8, cURL 8.21.0, elinks 0.19.1, ethtool 7.1
• expat 2.8.2, file 5.48, glib 2.88.2, harfbuzz 14.2.1, hwdata 0.409, json-c 0.19, kbd 2.10.0, Knot 3.5.6, Knot Resolver 6.4.2
• less 704, libarchive 3.8.8, libjpeg 3.2.0, lsof 4.99.7, OpenSSH 10.4p1, OpenSSL 3.6.5, pango 1.58.0, perl 5.42.2, perl-Net-DNS 1.55
• protobuf 35.1, SQLite 3.53.3, sysstat 12.7.9, systemd 261.1, tzdata 2026c, vim 9.2.0769, wireless-regdb 2026.05.30

Add-ons

• Observium Agent: can now report the status of the Apache web server.
• Zabbix: now collects metrics from Knot Resolver.
• Avahi: no longer hangs at shutdown when the daemon was not running. The hang came from an unhandled error.
• Updated: ALSA 1.2.16, ClamAV 1.5.3, dnsdist 2.1.0, fetchmail 6.6.6, FFmpeg 8.1.2, Git 2.55.0, HAProxy 3.4.2, ltrace 0.8.1, monit 6.0.0
• Also updated: nano 9.1, netsnmpd 5.9.5.2, Postfix 3.11.4, rsync 3.5.0, strace 7.1, stunnel 5.78, tmux 3.7b, transmission 4.1.3, tshark 4.6.7

Coming next

• The project says monitoring and reporting will be substantially expanded to show more about firewall activity and network behaviour. Details are promised soon.

Summary by DistroNews, based on the original post.