IPFire 2.29 Core Update 203 is live, marking the project's biggest backend shift as it replaces the long-standing Unbound resolver with the modular Knot Resolver. The swap unlocks DNS over TLS, a native DNS Firewall, network-wide SafeSearch enforcement, and persistent caching that survives reboots. Beyond the DNS overhaul, the release brings 6 GHz WiFi band support, IMDSv2 authentication for AWS EC2 deployments, and critical patches for strongSwan and Intel processor microcode. Upgrading administrators should be aware that forwarded zones can no longer use fully-qualified domain names, requiring a quick manual swap to IP addresses before the transition completes.

IPFire ships Core Update 203, swapping Unbound for Knot Resolver in its biggest backend overhaul yet

The new 2.29 release adds DNS over TLS, a native firewall, WiFi 6E support, and IMDSv2 for AWS, though upgrading administrators will need to adjust a few settings.

IPFire 2.29 Core Update 203 is out. If you're running a recent install, you've probably already seen the notification. But the real story here isn't the routine package bumps. It's a complete swap of the DNS resolver under the hood.

The 2.29 development branch has been moving at a clip that would have impressed IPFire's founders a few years ago. CU 200 dropped in early March on a fresh Linux kernel rebase. CU 201 shipped the highly requested DNS Firewall six weeks later. CU 202 followed in May with OpenVPN offloading and kernel hardening. Now CU 203 lands on July 20, and it carries the architectural weight.

Why Unbound is out and Knot is in

Unbound served the project well for over a decade. It's stable, familiar, and quietly does its job. But modern DNS does more than just hand out IP addresses. It negotiates encrypted transport, validates certificates, and carries policy signals that other services depend on. To actually build a DNS Firewall that doesn't rely on client-side tweaks or HTTPS inspection, IPFire needed something with a modular, scriptable foundation. Unbound wasn't it. Knot Resolver is.

Knot Resolver, built by CZ.NIC and widely deployed by Cloudflare's 1.1.1.1, is designed to scale from residential routers to massive ISP infrastructure. The switch unlocks DNS over TLS for upstream queries, persistent caching that survives reboots, and multi-worker parallelism that actually uses modern CPU cores instead of fragmenting the cache. It also means you can finally enforce SafeSearch across Google, Bing, and YouTube network-wide without begging users to toggle a setting in their browser.

There's a known snag. Forwarded zones can no longer be entered as fully-qualified domain names. If your configuration pointed a forwarded domain at dns.example.com instead of an IP, you'll need to swap it out before or during the upgrade. It's a minor migration step, but skipping it will break your custom routing.

Hardware and cloud updates

On the hardware front, the built-in access point now supports the 6 GHz band. If you're still wrestling with 2.4 and 5 GHz congestion, this is a noticeable win. Wider channels, no radar detection headaches, and cleaner airtime across the board. AWS users get a quiet but important update: IMDSv2 support for EC2 metadata retrieval. The older tokenless IMDSv1 protocol has been a long-standing SSRF liability. IPFire's new setup enforces the modern token-based handshake while still falling back to v1 for legacy deployments.

The package inventory is heavy. OpenVPN sits at 2.7.4, Suricata is at 8.0.6, and strongSwan 6.0.7 ships a patch for CVE-2026-47895, a security fix in the IPsec implementation. Intel processor microcode has also been updated to address INTEL-SA-01420, keeping firmware-level defenses current on supported platforms. Plus, a brand-new zone-sync tool pulls filtering zones over encrypted TLS with incremental updates, which means the DNS Firewall stays fresh without exposing plaintext HTTP requests.

It's a solid modernization push. Replacing a tried-and-true resolver with something that actually speaks modern DNS expectations is the kind of housekeeping enterprise firewalls get paid a fortune to do. The six-week release cadence on 2.29 is genuinely impressive for a volunteer-driven project, though the FQDN breaking change will definitely trip up a handful of power users mid-upgrade. Not exactly catastrophic, but the docs should make that migration step impossible to miss.

The release is available now via the standard upgrade path. Keep in mind that the testing build has been circulating since June 10, so the community has had roughly five weeks to poke at it.

Head here to grab the ISOs or check the full changelog on the official blog.