IPFire Opens Core Update 205 to Testing, with a Translation Overhaul and Command-Injection Fixes
There's a Core Update for IPFire ready for testing now, and it's a fuller-than-usual one. Michael Tremer announced IPFire 2.29 - Core Update 205 today, and the team's ask is straightforward: install it on a throwaway system and report what breaks.
On the surface, a "Core Update" sounds like routine maintenance. Much of CU205 is exactly that. But it pulls double duty by combining a ground-up rework of how IPFire speaks to non-English-speaking admins with a pile of real security fixes, including two command-injection flaws in an actively used add-on.
The current 2.29 line gets these incremental patches rather than big version jumps. CU199 went stable back in January. CU200 marked the 200th core update. CU201 delivered the long-awaited DNS firewall, and CU203 swapped Unbound for Knot Resolver mid-year. CU204 followed. Now CU205 is live in the testing channel.
The translation overhaul is the headline
The single biggest change in CU205 is also the one you can't see. IPFire has thrown out its home-grown localization system and rebuilt the entire web interface on GNU gettext, the same standard most major open-source projects use.
Developers pushed through every single interface message. Sentences once stitched together from code fragments are now whole. Labels read consistently. Common terms are spelled identically across the screen. That matters more than it might at first glance. A firewall is only as safe as the person configuring it, and translators previously had to work with broken shards. Now they translate meaning, not puzzle pieces.
All the work has moved to IPFire's own Weblate instance at translate.ipfire.org. No Git. No developer tooling. Open a browser, pick a language, start translating. It's already paying off: community contributions have arrived for Croatian, Danish, French, German, Hungarian, Italian, Japanese, Persian, Polish, Brazilian Portuguese, Romanian, Russian, Spanish, Swedish and Turkish, with Dutch on the way.
The installer picks up Hungarian, Romanian and Swedish. Portuguese is being quietly dropped in favor of Brazilian Portuguese, which is further along. The installer image is smaller now, compressed with zstd and stripped of graphics drivers it never uses.
Security fixes that matter
If the translation work is the shiny new part, the security changes are probably what you actually care about.
Two command-injection vulnerabilities in the WIO ("Who Is Online") add-on have been patched. WIO lets you see which hosts are active on your network and what they're doing, but its deep integration into the web server makes it a tempting target. These flaws let an attacker run shell commands as the web server user. The team strongly recommends all WIO users update immediately.
IPFire has also stopped the web UI from launching a shell at all. Rather than patch individual holes one by one, it removed the whole mechanism, shutting down an entire class of potential vulnerabilities before they exist. Also in the bucket: compromised root certificates have been pulled from the certificate store, the IPS no longer inspects encrypted ESP traffic, and the DNS resolver's outgoing access is now restricted to DNS ports.
The ThreatFox ruleset pull now requires an Auth-Key, a reasonable move against hotlinking and abuse of abuse.ch's indicators-of-compromise feed.
LoongArch and the rest of the stack
Under the hood there's a fair amount of housekeeping. strongSwan moves to 6.1.0. The initramfs now builds with dracut instead of dracut-ng, and GRUB is back to using UUIDs to find root filesystems on RAID. Add-ons get a refresh too: the Zabbix agent can now collect metrics from Suricata, python3-zabbix-utils 2.0.4 arrives, and alac has been dropped since shairport-sync no longer needs it. The base package list refreshes OpenSSL to 3.6.5, OpenSSH to 10.5p1, glibc to 2.44, Suricata to 8.0.8, and systemd to 261.3, among many more.
CU205 also marks IPFire's entry into LoongArch, the fourth 64-bit architecture it supports after x86-64, ARM and RISC-V. The port happened thanks to a hardware gift from China's Loongson Hobbyists' Community, a machine built around a 3A6000-HV processor on an XA61200 motherboard. It's now the fastest build server in IPFire's farm, finishing a full build in just over two hours versus roughly seven on real RISC-V hardware and somewhere in the 54-to-56-hour range under emulation.
Even administrators who never run LoongArch benefit, since a cleaner, architecture-independent build makes audits and bug reproduction easier. IPFire stresses there is "only one edition" of the project, with no feature gated behind a licence and no update requiring a subscription, so the sovereignty angle is meant for everyone. It's a somewhat ambitious move for a firewall that's roughly 185 releases old and run by about 30 core contributors, though the demand for lock-in-free hardware is genuine in parts of its user base.
Get involved
CU205 is in the testing channel, not stable, so take a backup before you touch anything. Switch to testing in IPFire's update settings and report issues through Bugzilla. The project also invites readers who depend on IPFire to consider sponsoring, which funds its continued independent, subscription-free development.
Head here to the release announcement.
