IPFire: Firewall and Router Ledger 2026 Scorecard

Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community project
Owner: The IPFire project, an independent team (31 people listed, six named as core developers); funded by sponsors and by Lightning Wire Labs, which sells appliances and professional support; no investors; legal form and country not stated on the project page
Licence: Open source, one edition; no feature needs a licence and no update needs a subscription; the licence name is not shown on the project page (see open questions)
Latest release: IPFire 2.29 Core Update 204 (October 2026, exact day not shown on the blog list); Core Update 203 on 2026-07-20
Support lifecycle: Rolling Core Updates on the 2.29 branch, each replacing the last; in-place upgrades through Pakfire; no long-term branch and no published end-of-life dates
Next milestone: none published (the DNS Firewall named as the next milestone in March 2026 shipped in Core Update 201 on 2026-04-28)
Security record: 0 CISA KEV entries since 2023 (catalogue checked 2026-10-15); kernel and library fixes ship inside Core Updates; no central advisory page found
Hypervisors: No official support matrix; community guides cover Proxmox VE (QEMU guest agent included), KVM, Hyper-V, VMware, XCP-ng and VirtualBox; cloud images for AWS, Exoscale and Hetzner Cloud; x86-64 and aarch64 images, RISC-V experimental; Azure and GCP not found
Tier: Open-source platform
Archetype: Dependable builder
Evidence grade: B. The project page, the download page, the FRR add-on documentation, the blog release list and the CISA catalogue were read from primary sources; the 2026 Core Update contents come from the blog and from news coverage. Release dates before 2026 come from Wikipedia and news sites, and the Core Updates that introduced FRR, Suricata, the captive portal and the cloud images were not dated, so those steps are placed by year and flagged. High availability, an API and NetFlow export were searched for and not found rather than confirmed absent.

Scorecard

Dimension	Score	Direction
Capability today	56.2 / 100	higher is better
Momentum since end of 2022	+2.4 points (2015 to 2022: +5.4)	higher is better
Credibility	15.5 / 25	higher is better
Sustainability risk	10.0 / 25	lower is better
Technical lock-in	6.5 / 25	lower is better
Integrator fit	3.5 / 20	higher is better
AI leverage	0.5 / 20	higher is better
Ledger Index	48.1 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Routing and WAN (12)	1.5	2.5	2.5	2.5
Firewall and NAT core (12)	3	3	3	3
VPN and remote access (12)	3	3	3	3.5
Threat protection (12)	2.5	3	3	3.5
Network services (8)	3	3.5	3.5	3.5
Platform and hypervisor freedom (10)	2.5	2.5	3	3
High availability and performance (8)	1	1	1	1
Management, API and automation (10)	2	2	2	2
Observability (6)	2.5	2.5	2.5	2.5
Platform security and lifecycle (10)	3	3	3	3
Total / 100	48.4	52.8	53.8	56.2

Year by year: 2015: 48.4 · 2016: 48.4 · 2017: 48.4 · 2018: 50.8 · 2019: 52.8 · 2020: 53.8 · 2021: 53.8 · 2022: 53.8 · 2023: 53.8 · 2024: 53.8 · 2025: 55.0 · 2026: 56.2

What moved the score

Year	Domain	Change	Points	Trigger
2018	Routing and WAN	1.5 → 2.5	+2.4	FRR add-on: BGP, OSPF, IS-IS, RIP, PIM and LDP from the command line (Core Update 125; year not sourced in the dossier); still no multi-WAN failover
2019	Network services	3 → 3.5	+0.8	Captive portal and a DNSSEC-validating resolver (Core Update numbers and years not sourced in the dossier); Knot Resolver replaced Unbound in Core Update 203; no RADIUS server or DHCP failover
2019	Threat protection	2.5 → 3	+1.2	Suricata replaces Snort as an inline IPS with several rulesets (Core Update 131; year not sourced in the dossier)
2020	Platform and hypervisor freedom	2.5 → 3	+1.0	Cloud images for AWS, Exoscale and Hetzner on x86-64 and aarch64 (introduction year not sourced in the dossier; placed at 2020); no Azure or GCP, no hardware acceleration
2025	VPN and remote access	3 → 3.5	+1.2	WireGuard added and improved (coverage dated 2025-07), OpenVPN overhaul (2025-09) and OpenVPN 2.7 in Core Update 202; no MFA integration or ZTNA client
2026	Threat protection	3 → 3.5	+1.2	Core Update 201: DNS Firewall with content filtering; Core Update 204: anti-phishing Suricata ruleset; IPFire DBL blocklist still beta; no TLS inspection, sandboxing or vendor threat intelligence

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2025-07	WireGuard improvements and console graphics stack modernisation	VPN	C
2025-09	OpenVPN overhaul and power saving	VPN	C
2026-01	Core Update 199: Wi-Fi 6 and 7 access point mode, LLDP and CDP	Network services	C
2026-01	Core Update 199: Linux 6.12.58	Security and lifecycle	U
2026-03	Core Update 200: Linux 6.18.7 LTS; IPFire DBL blocklist in early beta to replace the retired Shalla list	Threat protection	C
2026-04	Core Update 201: DNS Firewall with native content filtering	Threat protection	V
2026-05	Core Update 202: kernel security fixes and OpenVPN 2.7	Security and lifecycle	U
2026-07	Core Update 203: Knot Resolver replaces Unbound (DNS regression for VPN clients)	Network services	C
2026-10	Core Update 204: Linux 6.18.54, VPN DNS fix, anti-phishing Suricata ruleset	Threat protection	C

Centre of gravity: Threat protection (3), VPN (2), Network services (2)
Blind spots (no items): Routing, Firewall core, Platform, High availability, Management and API, Observability, Packaging, Licensing, AI
Driver mix: Vision 11%, Customer need 67%, Market window 0%, Upstream 22%, Portfolio 0%
Idea-to-need index: 0.14 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 15.5 / 25

Criterion	Score	Basis
Cadence	3.5	A Core Update every one to two months with a testing release announced first (199 in January, 200 in March, 201 in April, 202 in May, 203 in July, 204 in October 2026); no published schedule
Roadmap transparency	3	Release notes per update and blog posts that explain direction; a bug tracker exists; no written roadmap
Say-do	3	Few promises on record; the DNS Firewall named as the next milestone in March 2026 shipped in the next update; the DBL blocklist GA status is unconfirmed
Velocity	3	One or two substantive items per Core Update (WireGuard, DNS Firewall, Knot Resolver, Wi-Fi 7 AP) around kernel and library updates
Lifecycle stability	3	Rolling model with one supported branch and in-place upgrades; the Unbound to Knot Resolver swap caused a regression fixed one update later

Sustainability risk: 10.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	3.5	Six named core developers inside a 31-person team; one lead developer has carried the project since 2004
Backer health	3	Sponsor donations and one small company, Lightning Wire Labs, that sells appliances and support; no foundation and no investors
Licence-change risk	1	Open source without a single corporate owner; the licence name was not read from the project page
Abandonment signs	1	Six Core Updates in 2026 and a project history since 2004
Security response	1.5	Kernel and library fixes ship in regular Core Updates and no KEV entries exist; no central advisory page was found

Technical lock-in: 6.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	1.5	Plain text configuration under /var/ipfire and a backup archive
Export path	2	Readable text configuration; no converter to other firewalls
Stack coupling	0.5	Runs alone with any upstream and any switch
Hardware / cloud coupling	0.5	Any x86-64 or aarch64 machine, fully offline
Skills and tooling coupling	2	Own colour zone model and Pakfire package manager; general Linux skills transfer partly

Integrator fit: 3.5 / 20

Criterion	Score	Basis
Partner programme openness	1.5	No partner programme found; Lightning Wire Labs sells appliances and support
Multi-tenancy and self-service	0.5	None
API and infrastructure-as-code	0.5	No API, Terraform or Ansible content found
Skills and certification	1	Documentation and community forum; no training or certification found

AI leverage: 0.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI in threat detection	0	0	0	2015: None
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	0.5	0.5	0.5	2015: No API; SSH and the web UI only; no MCP server found

Year by year: 2015: 0.5 · 2016: 0.5 · 2017: 0.5 · 2018: 0.5 · 2019: 0.5 · 2020: 0.5 · 2021: 0.5 · 2022: 0.5 · 2023: 0.5 · 2024: 0.5 · 2025: 0.5 · 2026: 0.5

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items were announced from 2023 to 2026; the DBL blocklist is a curated list.

IPFire uses no AI in detection or operations and announces none. Without an API there is nothing for an agent to drive beyond SSH.

Reading

IPFire earns its points in threat protection and the VPN set, where inline Suricata, the new DNS Firewall, WireGuard and a rebuilt OpenVPN give a small site more filtering than most free firewalls, and in buyer safety, because there is nothing to buy and nothing to export from except text files. The scores stop where the product stops: no failover, no API, no central management, dynamic routing only through a command-line add-on and no official statement on which hypervisors it supports. The sustainability risk sits in the middle because the project is twenty years old and ships every few weeks, yet depends on a handful of developers and one small company. A buyer should check IPv6 support against their needs before choosing it, because the research did not assess it and the firewall line is scored without it.

Open questions and items to re-score

The exact release date of Core Update 204 and the Core Update dates for 2023 to 2025 were not found; the direction list covers 2025 and 2026 only.
The licence name is not shown on the project page; a GPL family licence is expected and should be confirmed from the source tree.
The Core Updates that introduced the FRR add-on (125), Suricata (131), the captive portal and the cloud images were not dated; the steps in 2018, 2019 and 2020 are placed by year and should be checked against the release archive.
IPv6 routing and firewalling were not assessed by the researcher; if absent, the routing and firewall lines would fall by half a step each.
Backup and restore in the web UI was not read from a documentation page.
Whether SNMP and NetFlow add-ons exist and are maintained.
GA status of the IPFire DBL blocklist, in early beta on 2026-03-02.
The country and legal form of the project and the location of Lightning Wire Labs.

	’18	’19	’20	’25	’26
Routing and WAN	1
Firewall and NAT core
VPN and remote access				1
Threat protection		1			1
Network services		2
Platform and hypervisor freedom			1
High availability and performance
Management, API and automation
Observability
Platform security and lifecycle