I cannot update the firmware on any of my Tapo cameras (c500; c320ws)  with the IPFire firewall protecting my network.  IF I setup a 2nd network bypassing the firewall altogether the firmware update process with my Android phone works.  As you can imagine this is a huge pain in the  a$$.  Removing cameras in question from one network and installing them on the other, connecting phone etc; disconnecting putting cameras back etc.  

So my question is are there ports that I can expose (temporarily of course) on my IPfire firewall that will enable the firmware process to occur?  Something must be getting blocked and I can't at this point find out what it is.

My network configuration when the firmware update fails consists of:             Internet<----------> Ipfire firewall<----------> Deco BE85 mesh router<----------> Tapo cameras;Android phone device.  The Android tapo app gives a non-descript update failed message.

My network configuration when it succeeds consists of:                                  Internet<----------> AX11000 Tp link router<----------> Tapo cameras;Android phone device.  

I have not tried putting the IPfire firewall between the Internet and the AX11000 router to see if I can eliminate the Deco BE85 router as the problem.  This is just way to much disruption to my network.