Introduction
IPFire is a hardened, open-source Linux distribution designed primarily as a router and firewall. Built on Linux From Scratch, it provides enterprise-level security features including stateful packet inspection, intrusion detection and prevention, VPN capabilities, and web proxy services.
Important Note: The IPFire development team recommends using physical hardware for production firewall deployments. However, IPFire on a VPS is excellent for testing, development, lab environments, or as a VPN gateway where security trade-offs are acceptable.
Network Zones
IPFire separates networks into security zones using a color-coded system:
| Zone | Description |
|---|---|
| GREEN | Trusted internal LAN. Clients have unrestricted access and connect locally. |
| RED | Untrusted external network (Internet). All traffic is blocked unless explicitly permitted. |
| ORANGE | DMZ (Demilitarized Zone). For servers accessible from the internet like web and FTP servers. |
| BLUE | Wireless network zone. Isolated from GREEN for additional security. |
Based on Linux Netfilter for robust traffic control
IPS/IDS with Emerging Threats rulesets
OpenVPN and IPsec for secure connections
Squid-based proxy with content filtering
Prerequisites
RamNode VPS Requirements
| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 1 GHz x86_64 | 2+ cores |
| RAM | 1 GB | 2+ GB (especially if using IPS) |
| Storage | 4 GB | 20+ GB (for logs and proxy cache) |
| Network | 1 NIC (VPS setup) | 2+ NICs for full functionality |
What You'll Need
- A RamNode Cloud VPS account
- Access to the RamNode Cloud Control Panel at cloud.ramnode.com
- IPFire ISO image downloaded from the official website
- A tool for converting the ISO to QCOW2 format (qemu-img)
- Basic understanding of networking concepts and firewall principles
Preparing the Image
Download IPFire
Download the latest IPFire ISO from the official website. Select the x86_64 ISO image for your RamNode VPS.
https://www.ipfire.org/downloadsAfter downloading, verify the SHA256 checksum to ensure file integrity.
Convert ISO to QCOW2
The RamNode Cloud Control Panel supports custom images in QCOW2 format. Create a bootable image on a local machine with qemu installed:
qemu-img create -f qcow2 ipfire.qcow2 20GBoot the ISO and install to the QCOW2 image:
qemu-system-x86_64 -enable-kvm -m 2048 -cdrom ipfire.iso -hda ipfire.qcow2 -boot dComplete the installation within the VM, then shut down. Compress the image for faster upload:
qemu-img convert -c -f qcow2 -O qcow2 ipfire.qcow2 ipfire-compressed.qcow2Uploading to RamNode Cloud
Upload via Cloud Control Panel
- Log into the RamNode Cloud Control Panel
- Navigate to Compute → Images
- Click "Create Image"
- Select "File" as the source
- Choose your prepared IPFire QCOW2 image file
- Specify the image details:
- Name: IPFire 2.29 (or your version)
- Format: QCOW2
- Minimum Disk: 20 GB
- Minimum RAM: 1024 MB
- Click "Create Image" to begin the upload
Tip: For images over 2GB, the web interface upload may be slow. Contact RamNode support for assistance with large image uploads or use alternative methods like SCP/SFTP or S3-compatible storage import.
Launching the Instance
Launch IPFire Instance
- Navigate to Compute → Instances in the Cloud Control Panel
- Click "Launch Instance"
- Select your uploaded IPFire image as the boot source
- Choose an appropriate flavor (at least 1GB RAM, 20GB disk)
- Configure networking (assign a public IP address)
- Launch the instance
- Access the console via the VNC viewer in the control panel
Initial Configuration
System Configuration
Complete these configuration steps after the base system installs:
- Keyboard Layout: Select your keyboard layout (US is typically appropriate)
- Timezone: Set your timezone for accurate logging and scheduling
- Hostname: Enter a hostname for your firewall (e.g., "ipfire" or "fw01")
- Domain Name: Enter your domain (e.g., "localdomain" or your actual domain)
- Root Password: Set a strong password for command-line (SSH) access
- Admin Password: Set a strong password for web interface access
Network Configuration
VPS Network Constraints: Traditional IPFire deployments require at least two network interfaces (RED and GREEN). On a single-NIC VPS, configure a GREEN + RED setup where the single interface handles external traffic. This is suitable for VPN gateway or remote access scenarios.
- Select "Network configuration type" and choose GREEN + RED
- For "Drivers and card assignments," assign your VPS's network interface to the appropriate zone
- Configure the GREEN interface with a private IP address (e.g., 10.0.0.1/24)
- Configure the RED interface with your VPS's public IP address, subnet mask, and gateway
- Set DNS servers (you can use 1.1.1.1 or 8.8.8.8)
Single-NIC VPS: For a VPS with only one network interface, assign it to the RED zone and access the management interface through a VPN tunnel or SSH port forwarding. This is the most common VPS deployment scenario.
Accessing the Web Interface
Access IPFire Dashboard
After completing the setup and rebooting:
- Open a web browser and navigate to:
https://<your-ipfire-ip>:444- Accept the self-signed SSL certificate warning
- Log in with username "admin" and the password you configured
- You'll be presented with the IPFire dashboard showing system status
Note: Port 444 is the default HTTPS port for IPFire's web interface. Port 443 is reserved for the web proxy. Ensure you've allowed access to port 444 in your firewall rules.
Firewall Configuration
Basic Firewall Rules
Navigate to Firewall → Firewall Rules to manage traffic flow:
- Outgoing Rules: Control traffic leaving your network to the internet
- Port Forwarding: Forward external ports to internal services
- External Access: Allow specific services to be accessed from RED zone
- Internal Access: Control traffic between internal zones (if configured)
Essential Services to Allow
For a VPS deployment, consider allowing external access to:
- SSH (port 22): For command-line management
- Web interface (port 444): For web-based administration
- OpenVPN (UDP 1194): For VPN functionality
- IPsec (UDP 500, UDP 4500): For IPsec VPN connections
VPN Configuration
IPFire excels as a VPN gateway, supporting both OpenVPN and IPsec. This is one of the primary use cases for deploying IPFire on a VPS.
Additional Services
Security Best Practices
Regularly check for and apply system updates through the web interface or Pakfire.
Use unique, complex passwords for both root and admin accounts.
Restrict SSH and web interface access to specific IP addresses when possible.
If resources allow, enable the Intrusion Prevention System with updated rulesets.
Export your configuration regularly via System → Backup.
Review logs regularly for suspicious activity under Logs → Log Files.
Only enable services you actually need to reduce attack surface.
Troubleshooting
Additional Resources
Ready to Deploy IPFire?
Get started with a RamNode Cloud VPS and deploy your own enterprise-grade firewall and VPN gateway with complete control over your network security.