Overview
IPFire is a hardened Linux distribution that turns a small x86 box, a virtual machine, or a Raspberry Pi into a network firewall. It began in 2005 as a fork of IPCop and has been rebuilt on Linux From Scratch since version 2, so it is a complete operating system rather than a package you install on top of one. Everything is managed from a web interface, and it is free under the GPL.
The security stack is network-layer. A stateful Netfilter packet filter handles zones, NAT, port forwarding, and segmentation into LAN, DMZ, wireless, and guest networks. Suricata provides intrusion prevention with rulesets from Emerging Threats and Cisco Talos. Squid handles outbound web proxying with URL filtering and content blocking. IPsec, WireGuard, and OpenVPN cover remote access, and Pakfire adds optional packages on top.
What IPFire does not have is a web application firewall. There is no reverse proxy for your own web servers, no request parsing, no OWASP Core Rule Set, no bot management, and no API protection. The Suricata IPS matches signatures against traffic it can see in plaintext, which catches some known exploit attempts, but encrypted inbound HTTPS to your applications passes through uninspected. If you are protecting web applications, IPFire is the box in front of the box, not the thing doing the protecting.
Ratings Breakdown
Key Features
Stateful Packet Filter
Linux Netfilter firewall with zones, NAT, port forwarding, time-based rules, MAC rules, GeoIP country blocking, and SYN-flood rate limiting.
Suricata IPS
Deep packet inspection against Emerging Threats and Cisco Talos signature sets, with per-category rule selection and automatic ruleset updates.
Network Segmentation
Built-in LAN, DMZ, wireless, and guest zones with separate policy, which is how you actually put a web server behind IPFire.
Squid Web Proxy
Outbound proxy with transparent mode, URL filtering, MIME type blocking, traffic shaping, and LDAP, Active Directory, or RADIUS authentication.
VPN Gateway
IPsec, WireGuard, and OpenVPN for site-to-site and remote access, with hardware crypto acceleration and post-quantum key exchange on IPsec.
Pakfire Add-ons
Package manager for optional components including monitoring, backup tools, Guardian for log-driven blocking, and Tor.
Pros & Cons
Pros
-
Free and genuinely complete
No paid tier, no feature gating, no license keys. Everything the project builds ships in the free download under the GPL.
-
Runs on almost anything
An old thin client, a Raspberry Pi, or a VM all work, so the hardware cost for a small network is close to zero.
-
Strong network-layer security
Suricata with Emerging Threats or Talos rules plus GeoIP blocking and tight zone policy is a serious perimeter for the price.
-
Long-lived and actively maintained
Continuous Core Updates since 2005 with a stable release cadence, backed by a named development team rather than a single maintainer.
-
Manageable without the command line
The web interface covers firewall rules, IPS, proxy, VPN, and updates, which keeps it approachable for small IT teams.
Cons
-
Not a web application firewall
No reverse proxy, no request body parsing, no OWASP Core Rule Set, no rate limiting per endpoint. It cannot stop SQL injection or XSS against your applications.
-
Blind to encrypted inbound traffic
The IPS inspects plaintext only. HTTPS requests to your web servers pass through without payload inspection, and that is most attack traffic today.
-
No bot or API protection
Credential stuffing, scraping, and API abuse all look like ordinary allowed traffic to a packet filter.
-
Self-managed, self-supported
No SLA, no managed service, no vendor on call. Tuning IPS rules to avoid false positives is your job, and the forum is the support channel.
-
Single box unless you build around it
There is no built-in clustering or global anycast, so availability and DDoS absorption are limited by the one machine and its uplink.
Pricing
Pricing model: Free and open source (GPL); optional paid appliances and support from Lightning Wire Labs
Community
The full distribution, downloadable and self-hosted
- Every feature, no paywalled modules
- Core Updates for the life of the release
- Community forum and wiki support
- Emerging Threats and Talos IPS rulesets (free tiers)
Appliance
Preinstalled hardware or cloud appliances from Lightning Wire Labs
- Preconfigured hardware sized for the deployment
- Vendor support on the appliance
- Cloud appliance images
- Supports the upstream project
Commercial Support
Paid support and consulting for production deployments
- Direct engineering support
- Deployment and migration help
- Priority handling of issues
Our Verdict
IPFire is a good open source firewall that people keep finding when they search for a free WAF, so it is worth being blunt: it is not one. IPFire filters packets, terminates VPNs, proxies outbound web traffic, and runs Suricata against signature sets. None of that inspects an HTTP request to your application the way a WAF does, and the IPS cannot read encrypted inbound HTTPS at all.
Judged as what it is, it is excellent value. A retired mini PC and an afternoon gets you zone segmentation, GeoIP blocking, Emerging Threats rules, and WireGuard, for nothing. The project has shipped Core Updates since 2005 and the web interface means you are not hand-editing nftables. For a small office perimeter it is hard to beat at the price.
If the actual goal is protecting a web app, run a WAF behind it. BunkerWeb and SafeLine are free, self-hosted, and reverse-proxy based, which is the missing layer; ModSecurity or Coraza with the OWASP Core Rule Set does the same job inside your existing web server. See BunkerWeb vs IPFire for where the line falls. The two are complements, not alternatives.
Our verdict: A strong free perimeter firewall and a poor substitute for a WAF. Use it for the network, and put something else in front of your applications.
CVE Coverage
IPFire can detect and block attacks matching 105K+ known CVEs based on its supported rule sets.
Coverage by Attack Type
Latest Blockable CVEs
| CVE | Severity |
|---|---|
| CVE-2026-49294 | UNKNOWN |
| CVE-2026-20262 | MEDIUM |
| CVE-2026-9863 | UNKNOWN |
| CVE-2026-9862 | UNKNOWN |
| CVE-2025-15659 | UNKNOWN |
| CVE-2025-15658 | UNKNOWN |
| CVE-2026-52704 | UNKNOWN |
| CVE-2019-25746 | HIGH |
| CVE-2018-25436 | CRITICAL |
| CVE-2016-20084 | HIGH |
Frequently Asked Questions
Does IPFire include a web application firewall?
No. IPFire has a stateful packet filter, a Suricata intrusion prevention system, and a Squid forward proxy, but no reverse proxy or HTTP request inspection for your own applications. There is no OWASP Core Rule Set, no request body parsing, and no virtual patching. For that layer you need a real WAF such as BunkerWeb, SafeLine, or ModSecurity running in front of the web server.
Can the Suricata IPS stop SQL injection or XSS?
Only in narrow cases. Suricata matches signatures against traffic it can read, so a plaintext HTTP request carrying a well-known exploit pattern may be caught. Inbound HTTPS is not decrypted, which means most real attack traffic passes uninspected, and signature matching does not understand your application's parameters the way a WAF rule engine does. Treat the IPS as a bonus, not as application security.
Can I run IPFire and a WAF together?
Yes, and that is the sensible design. IPFire handles the perimeter, segmentation, and VPN, with your web server in the DMZ zone. A reverse-proxy WAF then sits directly in front of the application, terminating TLS so it can actually read requests. IPFire covers the network layer and the WAF covers layer 7; neither replaces the other.
What does IPFire cost?
Nothing. The full distribution is GPL licensed with no paid tier and no feature gating. Lightning Wire Labs sells preinstalled hardware and cloud appliances plus commercial support, and the project takes donations, but you can download and run everything for free indefinitely.
How does IPFire compare to pfSense or OPNsense?
They occupy the same category: free, self-hosted, web-managed perimeter firewalls. IPFire is Linux based with Netfilter and Suricata, while pfSense and OPNsense are FreeBSD based with pf. None of the three is a web application firewall, though OPNsense can front an application via its reverse proxy plugin. If web app protection is the requirement, the firewall choice matters far less than what you put in front of the application.
Ready to try IPFire?
Start with the free tier and upgrade as you grow.