Тег: ipfire

IPFire is a lightweight Linux distribution for use with firewalls and routers. The project has released a new update which introduces publicly supplied IP block lists. "The next Core Update is released: IPFire 2.27 - Core Update 170. It features new IP blocklists for the firewall engine, significant improvements to Pakfire, modernizes the default cryptographic algorithm selection for IPsec connections, as well as a new kernel, and a plethora of bug fixes and security improvements under the hood. IP-Reputation Blocking to keep known threats out: Based on prior development by Tim FitzGeorge, Stefan brought a new feature to the firewall engine, which allows the easy activation of various public IP-based blocklists, just by a single click. All enabled blocklists are updated automatically at an appropriate interval (a technique we already deployed for updating IPS rulesets), and protect against various threats, such as IP addresses or networks having a poor reputation, being involved with cyber crime hosting, or simply not allocated, hence no traffic should be routed to and from them."

Софт

The IPFire team have published a new update to their security and firewall focused distribution. A key update affects the project's intrusion prevention system (IPS): "Stefan contributed a patch series for notably improving the IPS, particularly when it comes to handling of ruleset providers. While many of the changes are done under the hood, the following are visible to the web interface: Monitoring mode can now be enabled for each ruleset provider individually. This makes baselining and testing much less of a hassle, since newly introduced IPS ruleset providers can now first be used for logging only, without risking disruptions or unintended side-effects. Parsing and restructuring changed or updated rulesets has been improved and is now faster by orders of magnitude. The downloader will now automatically check whether a ruleset has been updated on its providers' server by checking the ETag HTTP header. This allows us to drop the update interval selection; every IPS ruleset will now updated automatically on the appropriate interval."

Софт

IPFire 2.27 Core 164

The IPFire distribution is a minimal operating system intended for use on firewalls and routers. The project's latest release includes a new kernel (with Dirty Pipe fixes) along with a number of improvements to the firewall management software. "This update brings a couple of improvements for IPFire's firewall engine. Dropping any hostile traffic: Our IPFire Location Database contains a list of networks that are considered 'hostile' - a network nobody under any circumstance wants to communicate with at all like bullet-proof internet service providers or stolen/hijacked address space. This is enabled by default on new installations, but left disabled in this update. We strongly recommend for everyone to enable this on the Firewall Options page. Read more in a special post. A better source routing validation is being performed: The firewall will now reject any packets from systems that it cannot reach according to its own routing table. Packets that are not recognised by the connection tracking (because they might belong to an invalid connection) are now being logged to help with any debugging."

Софт

PFire is a Linux distribution that focuses on easy setup, good handling and high level of security, intended for use in firewalls and routers. The project has published a new update which focuses on improving network throughput. "In recent days and months, the development team has spent a lot of time on finding bottlenecks and removing those. Our goal is to increase throughput on hardware and bringing latency down, for a faster network. This update brings a first change which will enable network interfaces that support it, to send packets that belong to the same stream to the same processor core. This allows taking advantage of better cache locality and the firewall engine as well as the Intrusion Prevention System benefit from this, especially with a large number of connections and especially on hardware with smaller CPU caches."

Софт

"The first update of the year will be an enormous one. We have been working hard in the lab to update the underlying operating system to harden and improve IPFire and we have added WPA3 client support and made DNS faster and more resilient against broken Internet connections. This is probably the release with the largest number of package updates. This is necessary for us to keep the system modern and adopt any fixes from upstream projects. The DNS proxy working inside IPFire will now reuse any TLS and TCP connections for DNS resolution making it substantially faster. Before, a TCP or TLS connection had to be opened and closed after a response was received causing a lot of overhead. Please consider if your setup can run DNS-over-TLS to protect your privacy."

Софт