Even if running as a relay only, SOCKS port is still opened. This should be prevented via adding "SOCKSPort 0" to the configuration file in this case.
https://patchwork.ipfire.org/project/ipfire/patch/7ebcbd8d-254b-f71f-54d5-8b4b40f50f0d@ipfire.org/
https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=8a0be2033f8d932b1687df1b6515bfb72230acf2
https://blog.ipfire.org/post/ipfire-2-27-core-update-172-is-available-for-testing
https://blog.ipfire.org/post/ipfire-2-27-core-update-172-released