How to properly configure an Ubuntu/Linux gateway to allow FTP traffic to pass through it?

Question

linux

Ubuntu 16.04 with Gnome GUI is installed on the computer in order to set up a gateway on it for Internet traffic to pass through it. I must say right away that I am new to Linux, as such, I have not dealt with Ubuntu before, as well as Linux in general. I read articles on the Internet on setting up port forwarding so that traffic goes between two network interfaces. So everything works well, devices inside the network behind this server have access to the Internet. There was another problem. The fact is that within the local network itself there is a router to which a USB hard drive is connected, the TP-Link Archer C50 router. Before I started raising the server, this particular router worked as a gateway, and its FTP server could be accessed both from the local network and from the external one, indicating the white address issued by the provider. Now, I don't quite understand why. but inside the local network everything works just as well, but from the outside I can already connect to the FTP server of the local router, but I am informed about the problem of listing folders on the server. Here is my current IPTables configuration:

/etc/rc.local

iptables -F
#Probros FTP traffika cherez server
iptables -t nat -A PREROUTING -i enp6s1 -p tcp --dport 21 -j DNAT --to-destination 192.168.0.1
iptables -I FORWARD -i enp6s1 -o enx000ec6a60252 -d 192.168.0.1 -p tcp -m tcp --dport 21 -j ACCEPT
iptables -t nat -A POSTROUTING -o enx000ec6a60252 -p tcp --dport 21 -d 192.168.0.1 -j SNAT --to-source 192.168.0.2
iptables -t nat -A PREROUTING -i enp6s1 -p tcp --dport 20 -j DNAT --to-destination 192.168.0.1
iptables -I FORWARD -i enp6s1 -o enx000ec6a60252 -d 192.168.0.1 -p tcp -m tcp --dport 20 -j ACCEPT
iptables -t nat -A POSTROUTING -o enx000ec6a60252 -p tcp --dport 20 -d 192.168.0.1 -j SNAT --to-source 192.168.0.2
iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
#Probros veb-mordy routera na vneshnuu set
iptables -t nat -A PREROUTING -i enp6s1 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.1
iptables -I FORWARD 1 -i enp6s1 -o enx000ec6a60252 -d 192.168.0.1 -p tcp -m tcp --dport 80 -j ACCEPT
iptables -t nat -A POSTROUTING -o enx000ec6a60252 -p tcp --dport 80 -d 192.168.0.1 -j SNAT --to-source 192.168.0.2
#Probros trafika dlya rejima shluza
iptables -t nat -A POSTROUTING -o enp6s1 -j MASQUERADE
iptables -A FORWARD -i enp6s1 -o enp6s1 -j REJECT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
exit 0

Let me explain from the above:
1 . enp6s1 is an integrated network interface on the motherboard that looks to the external network, of course, it must receive DHCP settings from the provider.
2 . enx000ec6a60252 - network interface of an external USB network card that looks into the local network. The cable from it goes to the router, from which other devices are connected to the outside world via Wi-Fi or Ethernet.
3 . 192.168.0.1 - IP address of the TP-Link Archer C50 router, it runs, among others, ports 21 and 80. Both work fine inside the local network.
4 . 192.168.0.2 - IP address of the server in gateway mode (Ubuntu 16.04), which has the above network interfaces.
As you can see, I forwarded both FTP traffic (port 21) and the web interface of the router interface (port 80). Interestingly, in this way, if you connect to port 80 of a white IP address, then the traffic will be successfully redirected to the web face of the router, I can work with it, as usual, but this trick does not work with FTP. Here is what the FileZilla console outputs:

FileZilla Console

Status: Connecting to xxx.xxx.xxx.xxx:21...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Logged in
Status: Retrieving directory listing...
Status: Server sent passive reply with unroutable address. Using server address instead.
Command: LIST
Error: The data connection could not be established: ECONNREFUSED - Connection refused by server

I see for sure that the server accepted the authorization data (login and password), but when it wants to list the list of folders, it crashes into an error. It seems to me that the matter is in some crooked IPTables configurations.
UPD : The WinSCP FTP client further confirmed my suspicions. It throws this error:

Server sent passive reply with unroutable address 192.168.0.1, using host address instead.
The transmission channel cannot be opened. Cause: The connection was not established because the destination computer denied the connection request.

UPD2 : I added lines for port 20 to rc.local - nothing has changed ... I'm clearly writing something wrong.
UPD3 : I began to suspect that the router acting as an FTP server was wrong. Raised an FTP server on another computer within the local network, everything works the same way. That other computers, that the gateway server - freely connect to the FTP server at its internal address. If I access via an external white IP address, I fail, everything ends up in the FileZilla server logs with the following lines:

(000009)25.07.2018 18:40:28 - user (192.168.0.2)> STAT
(000009)25.07.2018 18:40:28 - user (192.168.0.2)> 500 Syntax error, command unrecognized.
(000009)25.07.2018 18:40:28 - user (192.168.0.2)> SYST
(000009)25.07.2018 18:40:28 - user (192.168.0.2)> 215 UNIX emulated by FileZilla
(000009)25.07.2018 18:40:28 - user (192.168.0.2) > PASV
(000009) 07/25/2018 18:40:28 - user (192.168.0.2) > 227 Entering Passive Mode (192,168,0,3,250,221)

Answer 1

FTP is a very old protocol developed during the "secure internet" era which ended around 2004... It has two ports and two directions of traffic - a control port and a data port. And two modes - active and passive. Port 21 is the control port, commands are issued on it. But all the data, even the contents of the folders, is transmitted over port 20 - ftp-data. And just then the piano is playing - active or passive (lieutenants, be silent!).
The active server gives the client a port on which it will connect to the client and transmit data. Passive waits for a port from the client, but it will still connect itself.

Answer 2

FTP is a chore. 20 more and gt 1024 ports are needed there, depending on the connection mode (active, passive)
To simplify, dig in the direction of nf_conntrack.

Answer 3

IPT -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
permission for initiated connections can try to add