IPFire: Knot Resolver replaced by Unbound

IPFire has announced that its upcoming Core Update 203 will replace the previously used DNS resolver Unbound with Knot Resolver. This change marks a fundamental shift in the distribution’s DNS infrastructure, aimed at enhancing security, performance, and flexibility. The update introduces several new features, including support for encrypted DNS over TLS, network-wide DNS filtering, and a persistent resolver cache. Additionally, the integrated WLAN access point now supports the 6-GHz band of Wi-Fi 6E and Wi-Fi 7, offering improved performance in densely populated environments. The transition from Unbound to Knot Resolver represents a strategic move by the IPFire developers to modernize their core networking capabilities. According to the release notes, this replacement is part of a broader effort to make the system more adaptable and scalable. Knot Resolver operates in a modular fashion, allowing for script-based customization. IPFire leverages this modularity to extend functionality, such as integrating with DHCP leases and DNS filter lists. These enhancements enable administrators to manage network resources more efficiently while maintaining a high level of control and security. One of the key improvements introduced with Knot Resolver is the ability to securely forward DNS queries using DNS over TLS. This ensures that data transmitted between clients and upstream resolvers remains confidential and protected against interception or tampering. Administrators can now deploy external resolvers without exposing sensitive information through unencrypted channels. This feature aligns with growing concerns around privacy and data integrity in internet communications. In addition to enhanced encryption and forwarding capabilities, IPFire is introducing a DNS firewall that blocks domains associated with malware, advertising, and other undesirable categories during name resolution. The system uses the zone-sync tool to download zone files and filter data securely, updating them incrementally rather than transferring complete lists each time. This reduces bandwidth usage and improves efficiency. The SafeSearch feature, which forces searches to use safe search variants of supported search engines and YouTube, further strengthens content filtering within the network. IPFire also enhances local DNS management by preserving user-defined entries and conditional forwarding rules. These allow specific zones to be directed to designated DNS servers, such as internal networks or remote domains accessible via a virtual private network. The new resolver cache persists across restarts, reducing lookup times after reboot and alleviating pressure on higher-level DNS servers. Knot Resolver utilizes multiple worker processes to share cache and status information, enabling IPFire to utilize multiple CPU cores without requiring isolated caches per process. Administrators must adjust existing configurations to accommodate these changes. Previously configured fully qualified domain names (FQDNs) as forward zones are no longer accepted; instead, IP addresses must be used. This requires revisiting and modifying current DNS forwarding settings to ensure compatibility with the updated system. On the wireless front, IPFire's built-in access point now supports the 6-GHz frequency band, providing better performance for Wi-Fi 6E and Wi-Fi 7 devices. This spectrum offers less interference from older devices and allows for wider channels of up to 80 or 160 MHz, improving throughput and reliability. Unlike parts of the 5-GHz band, the 6-GHz spectrum does not require dynamic frequency selection (DFS) for radar detection, eliminating the need for access points to scan for free channels or switch frequencies upon detecting radar signals. This change helps prevent connection drops caused by unnecessary channel switches. For users deploying IPFire on Amazon Web Services (AWS), the update includes support for IMDSv2, the newer version of the instance metadata service. This token-based service provides greater security compared to the previous version, ensuring more robust authentication and data protection for cloud-hosted instances.