How to forward FTP traffic?

Question

NAS

There is a need to save database backups to network storage (QNAP NAS) located in the internal local network.
The domain is located in Google Cloud.
Communication with the ftp server goes through Google's internal addresses.
There is a separate server that works as a vpn proxy to a router on the local network (mikrotik)

the path from the web server to the ftp server
www--->vpn-proxy--->mikrotik--->ftp

Mikrotik's NAT rule, for ftp

chain=dstnat action=dst-nat to-addresses=10.10.10.22 to-ports=21 protocol=tcp src-address=10.8.1.1 dst-address=10.8.1.5 in-interface=ovpn dst-port=21021,55536-56559 log=no log-prefix=""

Ports 55536-56559 - Passive FTP port range on QNAP

Iptables for FTP on vpn-proxy

-A PREROUTING -s 10.xxx.xxx.xxx/32 -p tcp -m multiport --dports 55536:56559 -j DNAT --to-destination 10.8.1.5:55536-56559

Port 21 on vpn-proxy via nginx is sent to 10.8.1.5:21021 via upstream
netcat from www-server to QNAP FTP works
Attempt to upload file fails server response timeout
File of size 0 is created on ftp
Tell me what I forgot to do

Answer 1

ftp work in two different modes - passive and active. For active - you will have to enable ftp alg