It works!! 
In the Fritzbox, it’s no exposed host necessary. I just set TCP, external port 10021 to internal port 21 → forwarding to IPfire red (192.168.178.250). In IPfire this is my current configuration:
When I ping :10021 the port is open now! Important to know is the note of Steven X: set no source-port 
Thank you for support.