CyberIndexBeta

Product

Free open-source Linux firewall distribution for the user's own hardware or a VM, also sold as AWS and Exoscale cloud appliances. IPFire DBL (Domain Blocklist) is a community-powered, constantly updated blocklist that closes the gap between DNS filtering and deep packet inspection — blocking malicious, ad, and tracking domains across every protocol, not just port 53. From packet inspection to encrypted tunnels, IPFire delivers enterprise-grade protection through a management console that actually makes sense. IPFire creates hardened DMZs, isolated guest networks, and clearly separated trust zones — limiting blast radius before an incident ever occurs. It is available as a cloud instance and a virtual appliance.

Current Version
2.29 Core Update 204
Product Page
ipfire.org
Market
ConsumerEnterpriseGovernmentSMB
Licence
Open source
Price
Free
Record Created
2026-09-20
Last Updated
2026-10-28

Vendor

IPFire is not a company. It is an open-source firewall distribution — a hardened Linux system built specifically to be a firewall — developed by a community of volunteers and given away, with the source available to anyone. It has been in continuous development since 2005 and is maintained by a core team in Germany. What is listed here is the software itself and the hardware it is sold on: IPFire runs on ordinary x86 machines, on ARM boards and in virtual machines, and preinstalled appliances are available from partners for buyers who want supported hardware rather than a self-build. Its feature set is what a commercial UTM offers — stateful firewalling, an intrusion prevention system, web proxy and content filtering, VPN, quality of service — with add-on packages for the rest. The trade is the usual one for open-source infrastructure: no licence cost and full visibility of the code, in exchange for configuring and maintaining it yourself. There is no vendor to submit it to a testing laboratory, so its columns here will stay empty. Vendor page →

Website
ipfire.org
Country
Germany
Headquarters
Datteln, Germany
Year Established
2004
Customers
Not known
Users
100K deployments
Revenue
$100.0K (2025)

Platforms

Cloudnative
Virtual Appliancenative

Target Market

Consumer primaryEnterprise secondaryGovernment secondarySMB secondary

Capabilities

Stateful Inspectionkeynative
Intrusion Prevention (IPS)keynative
Intrusion Detection (IDS)native
SSL/TLS InspectionkeyNot known
VPN Gatewaykeynative
SD-WANNot known
Application ControlkeyNot known
High AvailabilityNot known
Deep Packet Inspectionnative
Central Management ConsoleNot known

5 of 10 not yet known — not recorded, which is not the same as not supported.

Specifications

Firewall TypeNetwork (NGFW / UTM)

4 other specifications for this category not yet known.

Pricing

PlanLicencePriced perBilledPrice
SummaryOpen sourcenot statedno recurring chargeFree

Versions

  • 2.29 Core Update 204platform not recordedreleased 2026-10-14

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

Not known

Change History

This record was created 2026-09-20. Everything below is what has changed since.

  • 2026-10-28New versionNew version: 2.29 Core Update 204evidence
  • 2026-10-08New versionNew version: 2.29 Core Update 203evidence
  • 2026-10-08Capability addedIntrusion Detection (IDS): built inevidence
  • 2026-10-07Pricing plan addedPrice: open sourceevidence
  • 2026-10-06Capability addedIntrusion Prevention (IPS): built inevidence
  • 2026-10-06Capability addedVPN Gateway: built inevidence
  • 2026-10-06Capability addedDeep Packet Inspection: built inevidence
  • 2026-10-06Capability addedStateful Inspection: built inevidence
  • 2026-09-20Product updatedAlso sold to: Governmentevidence
  • 2026-09-20Product updatedAlso sold to: Enterpriseevidence
  • 2026-09-20Product updatedAlso sold to: SMBevidence
  • 2026-09-20Product updatedSold to: Consumerevidence
  • 2026-09-20Platform addedRuns on Cloudevidence
  • 2026-09-20Product createdNew product, listed in Network Firewallevidence
  • 2026-09-20Platform addedRuns on Virtual Applianceevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.