The free, cryptographically signed database that tells your firewall which country and which network an IP address belongs to. It powers the rules by country in IPFire and is being used by Tor, F-Droid and many other projects.
Everything listed on this page is part of IPFire and free to use. There are no editions, no licences per user and nothing that is being held back for paying customers.
Based on Linux Netfilter, IPFire allows fine-grained control over incoming and outgoing traffic with support for zones, port forwarding, NAT, and stateful packet inspection.
IPFire supports IPsec, WireGuard and OpenVPN for secure site-to-site or remote access VPNs, with support for hardware acceleration and post-quantum cryptography for IPsec.
Powered by Suricata, IPFire detects and blocks malicious traffic in real-time using up-to-date rule sets, helping stop attacks before they cause damage.
Pakfire, the package manager of IPFire, installs add-ons with a single click — such as Tor, Samba, HAProxy, the Zabbix Agent or Borg Backup — and keeps them up to date.
IPFire includes a Squid proxy with optional URL filtering (via URLFilter or SquidGuard), helping organizations enforce usage policies and block harmful or inappropriate content.
Prioritize essential services like VoIP or video conferencing with IPFire’s traffic shaping capabilities, ensuring bandwidth is used efficiently even under load.
With its unique concept of zones (Red, Green, Blue, Orange), IPFire simplifies complex firewall rules by assigning roles to networks (e.g., trusted, DMZ, Wi-Fi).
IPFire is maintained by a dedicated team focused on security. Updates are released frequently to patch vulnerabilities and keep your systems secure.
Built-in tools let you monitor bandwidth usage, connections, intrusion attempts, and more — all through a user-friendly web interface.
IPFire provides a clean, intuitive interface for managing all aspects of your firewall — no need to touch the command line unless you want to.
Keep known attackers out before they can try anything: with IP address blocklists, rules by country or network operator, blocking of malicious domains and protection against anybody who is trying to guess passwords.
A firewall has to be able to defend itself. IPFire comes with a hardened kernel, is built with all compiler hardening enabled and has mitigations for CPU vulnerabilities turned on.
Our Own Technology
Some of what makes IPFire strong did not exist anywhere else, so we have built it ourselves and made it available to everyone.
Geolocation Database
The free, cryptographically signed database that tells your firewall which country and which network an IP address belongs to. It powers the rules by country in IPFire and is being used by Tor, F-Droid and many other projects.
Domain Blocklist
The community-maintained list of malicious, advertising and tracking domains. Together with the Intrusion Prevention System it blocks them on every protocol and not only in DNS.
Platforms
Any 64 bit x86 or ARM system with at least two network interfaces, from a small board to a server.
As a guest on all common hypervisors to protect what is running next to it.
Ready-made images for AWS, Exoscale and more. View Cloud Options
Hardware that has been built for IPFire, with professional support, from Lightning Wire Labs.
Reference
IPFire is not an app that you install on top of something else. It is a complete operating system based on Linux, hardened and tuned to do one job: protect your network. This is the full list of what it can do.
IPFire runs on hardware that you already own, in a virtual machine or in the cloud. Installing it takes a few minutes.