Access into green network

I have the following problem: I want to access a specific server that is in the green network from the red network, for example. E.g.
I have tried various rules but it does not work.

It only works to access the firewall red interface from the red network but not from the green network

Look for Port Forward. There is a thread right by yours.

1 Like

What did you set the Source to?

this might help:

Hi :slight_smile:
thanks for the quick reply.
I have applied exactly as in the documentation. However, it does not work.

@bruzzler I can only provide my specific setup that works, so depending on what exactly you need, set it up as follows:

The most important thing, I think, for me anyway, was the protocol, I used a “preset” option. Also, I do not think you need the “incoming firewall rule” so you could try removing that rule. Also please do not forget to click “apply rule” afterwards, or even better, reboot the whole IPFire box.
Just my 2cents.

1 Like

Have you confirmed that the web server you are running on or (both IP’s have been referenced in the thread) is actually working.

On another machine on the green network, what result do you get if you put into the browser url field.
That will work only on the green network so it doesn’t need anything from IPFire.

If when you run that url you don’t get the web page you expect to see from your web server then you need to get the web server working first.

If when you run that url you do get the web page you expect to see then we need to start looking at the IPFire logs to see what is blocking the access from the internet.

Just to confirm, your ISP is providing you with a public IP address to your red interface?

1 Like


Yes and work but only from the green network. I have not yet activated the ipfire as an exposed host. At the moment I have assigned a private ip from the fritzbox. I would like to configure everything correctly before I release the device into the WAN. I can only access the ipfire from the red (fritzbox network). But not to the devices that are in the green network. For example to the switch or access point

Have tried it like the unfortunately does not work

Okay, so you have a Double Nat connection with IPFire and a fritzbox between your green network an the internet.

What IP subnet are you using on the fritzbox. What IP does IPFire get on its red interface from your fritzbox.


Fritz Box:
Red interface:

Green int: (IP from

Okay so your green and red subnets are not overlapping, although it is not clear why you have your green subnet set up with rather than the default

So now you need to also create a port forward rule in your Fritzbox that allows your public IP to be forwarded from the internet to and your IPFire should have its rule changed from any for the source to as the traffic will only come to IPFire from the fritzbox.

1 Like

More info:
The fritzbox runs a DHCP server for Red only. And a DHCP server on the Ipfire only for Green. The Green /25 was a typo

Okay, no problems then.

I have understood the port forwarding. However, it does not solve the problem that I cannot access the devices from red into the green.

If you have a laptop or something that you can connect to the red connection between your fritzbox and IPFire then if the port forwarding rule has been correctly created you will be able to connect to the specified machines on green from red.

If that is not working then there must be an error in the port forward rules somewhere.

1 Like

I have implemented it as described here. However, no success.

The web server in green should be reachable from red as if you have defined a port forward rule with

source <Any>:80

A port forward rule opens the port on the red interface, DNAT maps the traffic to a service on an internal device.
From outside ( WAN ) it looks as if the server is located in the IPFire device.

See - Network Address Translation Reference and - Creating a Port-Forward Rule. - Forward Port 80 from Any network to Green is just an example.

Thanks to all for the help :slight_smile: