IPFire is a hardened open-source Linux firewall and router distribution for physical or virtual networks. Available for download at [Link] in x86 (64-bit) and ARM (64-bit) formats.
It uses its own package manager called Pakfire (not Debian or RHEL based), focused on simplicity and security.
Configuration is handled through a WebUI (e.g. https://10.10.10.1:444/), with SSH available for advanced management.
IPFire uses color-coded zones to classify network segments:
- RED
- WAN side.
- Public Internet.
- Interface name: red0.
- GREEN
- LAN side.
- Private internal network.
- Interface name: green0.
- BLUE (optional)
- DMZ (Demilitarized Zone).
- Limited protection network.
- Exposes specific ports (or all) to the Internet (e.g. port forwarding).
- ORANGE (optional)
- WLAN (wireless network).
- Segregated network for wireless devices.
Each zone requires a dedicated network adapter.
Key features include:
- Rate limiting and traffic logging.
- Quality of Service (QoS) for latency-sensitive applications like VoIP.
- Intrusion Prevention System (IPS) via Snort.
- Web proxy with content caching and URL filtering.
- Site-to-site VPN support via IPsec or OpenVPN.
- DNS proxy with DNSSEC and DNS-over-TLS (DoT).
- Captive Portal.
Common Pakfire commands:
- pakfire help
- Lists available commands and descriptions.
- pakfire install htop
- Installs a single package.
- pakfire install -y samba nano
- Installs multiple packages without a confirmation prompt.
- pakfire update
- Updates the package list.
- pakfire update –force
- Forces a package list update.
- pakfire upgrade
- Upgrades all installed packages to the latest version.
- pakfire upgrade –force
- Repairs a broken upgrade.
- pakfire list
- Lists all available packages.
- pakfire status
- Shows the current core update level and status summary.
To change the Pakfire repository, edit /opt/pakfire/etc/pakfire.conf and set your preferred mirror from the list at [Link].
Standard Linux commands also available:
- ip address
- ip route
- service ntp {status|stop|start|restart}
Note: keep your system updated. Like any internet-connected system, IPFire can be exploited if left unpatched. As an example, there is a known Metasploit module that exploits version 156 to obtain a reverse Meterpreter shell as admin [Link].