IPFire
Linux distribution
IPFire is a hardened open source Linux distribution that primarily performs as a router and a firewall; a standalone firewall system with a web-based management console for configuration.
IPFire originally started as a fork of IPCop (itself forked from Smoothwall). Since version 2, IPFire has been rewritten on the basis of Linux From Scratch. It supports installation of add-ons to add server services, which can be extended into a SOHO server. In April 2015, the project became a member of the Open Invention Network.
01System requirements
The basic requirements are at least a 1 GHz 64-bit CPU, 1GB of RAM, and a 4GB hard drive. Two network cards are needed to connect to an Ethernet network. DSL, LTE and Wi-Fi (WLAN) are supported, too, with corresponding hardware.
The required computing power to run IPFire depends on the area of application. Most commonly, x86 systems are being used, but ARM devices, such as Raspberry Pi or Banana Pi, are supported, too. IPFire can be used in virtual environments (such as VMware, VirtualBox, QEMU, KVM, Xen, etc.).
The basic setup of IPFire happens over a guided dialogue on the console, and the further administration takes place on the web-based management interface, such as add-ons and additional features.
02System details
The project is regularly updated by the development team to maintain security. Developed as a stateful packet inspection (SPI) firewall.
IPFire separates the network into different segments based on their security risk which are organised in colours. Normal clients connected to the LAN are represented as green, the Internet is represented as red, an optional DMZ is represented as orange and an optional Wireless network is represented as blue. No traffic can flow between segments unless specifically permitted through a firewall rule.
IPFire's package management system, called Pakfire allows to install system updates, which keep security up to date, and additional software packages for customisation to different usage scenarios and needs. The Linux system is customised for the concrete purpose of a firewall.
The design is modular, making its functionalities extensible through plugins, but the base comes with the following features
- Stateful packet-inspection firewall based on Linux Netfilter
- Proxy server with content filter and catching-updates functions (e.g. Microsoft Windows updates, virus scanners, etc.)
- Intrusion detection system (Snort) with the option to install the Intrusion Prevention System guardian via Pakfire
- Since Core Update 131 it features the intrusion prevention system "Suricata" instead of snort
- Virtual private network (VPN) with IPsec, WireGuard and OpenVPN
- Dynamic Host Configuration Protocol (DHCP) server
- Caching name-server (supports DNSSEC)
- Time server
- Wake-on-LAN (WOL)
- Dynamic DNS
- Quality of service (QoS)
- System monitoring functions and log analysis
- GeoIP filtering
- Captive Portal
03Internet geolocation database
The IPFire Project built a free Internet geolocation database published under the Creative Commons license. It is being used by The Tor Project to identify the location of Tor nodes and relays.
Sources and credits
This article is adapted from the Wikipedia article “IPFire”, written by its contributors and licensed under CC BY-SA 4.0. Fathomly has changed the layout, removed citation markers, navigation and maintenance notices, and adjusted punctuation. This adapted version is shared under the same license. For references, see the original article.
Images, from Wikimedia Commons:
- IPFire 2.21 - Web interface.png by Rollopack, CC BY-SA 4.0
Fathomly is not affiliated with or endorsed by the Wikimedia Foundation. Spotted a problem? Tell us.