New add-on: Firewall-Local — modular firewall orchestration for IPFire
Firewall-Local is an IPFire add-on that manages iptables/ipset rules through a small set of master-list files and a web UI, shipped as a standard .ipfire package. It adds five rule modules on top of IPFire’s native firewall, each with its own CGI page.
The integration is achieved via /etc/sysconfig/firewall.local.
Location Allow — INBOUND country allowlist. Default posture is drop everything; only the countries you add can reach the box (the opposite of native IPFire, which allows all traffic except the countries you select to block).
ASN Block — allow or block by Autonomous System Number (ASN — the ID for a network operator’s address space). Each ASN is expanded into a kernel ipset.
IP / CIDR Rules — per-IP, per-subnet, or per-ipset rules with multiport and multi-chain targeting (CIDR — the address/prefix notation, e.g. /24).
SMB Allow — let one named WiFi (Blue) host reach a Samba/NAS box while SMB stays dropped for every other Blue client (requires the firewall option Drop SMB to be on).
Outgoing Location Block — block outbound traffic to a long list of countries in a single ipset lookup. It loads from IPFire’s pre-built country ipset files.
Why it exists. It’s a thin orchestration layer over what IPFire already has — ipsets, the location database, the standard chains — aimed at edge cases that are awkward to express in the stock UI: pre-VPN blocks, per-host SMB exceptions, selective Squid proxy bypass, single-destination GeoIP holes, and keeping WHOIS / cert-check / encrypted-DNS traffic reachable even under an aggressive GeoIP posture. Where a feature depends on where a rule sits in the packet path, the placement is shown in the included firewall diagram — I’d rather you read it there than take my word for it.
What I develop I do it for my edge cases - I start by writing down what I need and is not easily covered by current UI and then start to develop that.
And, I do intend to add to it other edge cases - some lost in old IPFire forum like block traffic from/to a specific Company (Like block all Amazon) - this ideea was implemented and posted in old forum by Shellshock and Umegee
Version 1.8.0-ui was launched.
1.8.0-ui Version introduce “Company Block” feature
Feature list (why and when to reach for each module): Company Block
This modules has some limitations in Keys accepted as “search for company”.
Also, please be aware that one key can hit more than one Company - blocking more than it was meant to be blocked.
Version 1.8.1-ui was launched. 1.8.1-ui introduces an optional interim mitigation for CVE-2026-98432 (Linux kernel, IPv4 networking), as a modular script pair.
The real fix is the kernel in IPFire Core Update 205. This module only covers the gap until you can apply CU205.
The module ships switched off. To use it, set ENABLED=on in /var/ipfire/fw.local/ip-options.settings and run /etc/sysconfig/firewall.local reload. It then starts in log-only mode: matching packets are written to the system log and nothing is dropped. Watch the log first, and switch to ACTION=drop only when you know what it matches on your network. SCOPE=tcp limits it to TCP. The settings file is kept across updates.
Also included: a script pair that lets TCP/53 leave through ppp0 ahead of the outgoing country policy, so a recursive resolver still reaches authoritative name servers when its upstream DNS is unavailable.
Feature list (why and when to reach for each module): see the README.
Drop mode filters more than you may expect (for example IGMP and ping -R). Test in log mode first.
Good day,sir. Please forgive a really stupid question, could you please advise on how I unpack this package using the command line in IPfire? I know how to do it when the package ends in *.tar.gz, however, this package has a different extension, so I am bit stumped, or is the command the same regardless of the extension?