ftp nat / port forward не работает

у меня следующий env:

• мой компьютер как ftp клиент

• сервер (с именем HOST) с включенным firewalld и следующими правилами:

  public (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: ens192
  sources:
  services: ssh dhcpv6-client ftp
  ports: 20023/tcp 29000-29100/tcp 20021/tcp 21/tcp
  protocols:
  masquerade: yes
  forward-ports: port=20023:proto=tcp:toport=23:toaddr=10.1.1.2
          port=29000-29100:proto=tcp:toport=29000-29100:toaddr=10.1.1.2
          port=20021:proto=tcp:toport=21:toaddr=10.1.1.2
          port=21:proto=tcp:toport=21:toaddr=10.1.1.2
  source-ports:
  icmp-blocks:
  rich rules:
  

• виртуальный сервер (с именем APP) внутри сервера HOST с FTP-сервером на нем с пассивным портом диапазона от 29000 до 29100

Сетевая конфигурация сервера HOST:

ens192: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1492
        inet 10.10.12.6  netmask 255.255.255.0  broadcast 10.10.12.255

tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.1.1.1  netmask 255.255.255.0  broadcast 10.1.1.255

Когда я пытаюсь подключиться со своего клиента (с помощью filezilla) к FTP-серверу приложения, вход в систему работает, но DIR, GET или другие нет, и я не знаю, как правильно настроить свой env.

Кто-нибудь может помочь? Спасибо.

ОБНОВЛЕНИЕ 1 ЖУРНАЛА ОТЛАДКИ FILEZILLA

Stato:  Connessione a 10.10.12.6:20021...
Stato:  Connessione stabilita, in attesa del messaggio di benvenuto...
Trace:  CFtpControlSocket::OnReceive()
Risposta:   220-FTPDZDT1 IBM FTP CS V2R3 at APP, 11:47:16 on 2019-03-01.
Trace:  CFtpControlSocket::OnReceive()
Risposta:   220 Connection will close if idle for more than 5 minutes.
Trace:  CFtpControlSocket::SendNextCommand()
Comando:    AUTH TLS
Trace:  CFtpControlSocket::OnReceive()
Risposta:   534 Server is not willing to accept security mechanism
Trace:  CFtpControlSocket::SendNextCommand()
Comando:    AUTH SSL
Trace:  CFtpControlSocket::OnReceive()
Risposta:   534 Server is not willing to accept security mechanism
Stato:  Server non sicuro, non supporta FTP su TLS.
Trace:  CFtpControlSocket::SendNextCommand()
Comando:    USER <username>
Trace:  CFtpControlSocket::OnReceive()
Risposta:   331 Send password please.
Trace:  CFtpControlSocket::SendNextCommand()
Comando:    PASS ********
Trace:  CFtpControlSocket::OnReceive()
Risposta:   230 <username> is logged on.  Working directory is "<username>.".
Stato:  Il server non supporta caratteri non ASCII.
Stato:  Accesso effettuato
Trace:  CFtpControlSocket::ResetOperation(0)
Trace:  CControlSocket::ResetOperation(0)
Trace:  CFileZillaEnginePrivate::ResetOperation(0)
Trace:  Measured latency of 195 ms
Stato:  Lettura elenco cartelle...
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::ChangeDirSend()
Comando:    PWD
Trace:  CFtpControlSocket::OnReceive()
Risposta:   257 "'<username>.'" is working directory.
Trace:  CFtpControlSocket::ResetOperation(0)
Trace:  CControlSocket::ResetOperation(0)
Trace:  CFtpControlSocket::ParseSubcommandResult(0)
Trace:  CFtpControlSocket::ListSubcommandResult()
Trace:    state = 1
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::TransferSend()
Trace:    state = 1
Comando:    TYPE I
Trace:  CFtpControlSocket::OnReceive()
Risposta:   200 Representation type is Image
Trace:  CFtpControlSocket::TransferParseResponse()
Trace:    code = 2
Trace:    state = 1
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::TransferSend()
Trace:    state = 2
Comando:    PORT 10,199,168,245,211,254
Trace:  CFtpControlSocket::OnReceive()
Risposta:   200 Port request OK.
Trace:  CFtpControlSocket::TransferParseResponse()
Trace:    code = 2
Trace:    state = 2
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::TransferSend()
Trace:    state = 4
Comando:    LIST
Errore: Timeout connessione dopo 20 secondi di inattività
Trace:  CControlSocket::DoClose(2050)
Trace:  CFtpControlSocket::ResetOperation(2114)
Trace:  CControlSocket::ResetOperation(2114)
Trace:  CFtpControlSocket::ResetOperation(2114)
Trace:  CControlSocket::ResetOperation(2114)
Errore: Non è stato possibile leggere il contenuto della cartella
Trace:  CFileZillaEnginePrivate::ResetOperation(2114)

Обновление 2 новая конфигурация firewalld (нет пассивного диапазона портов на ftp-сервере)

public (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: ens192
  sources:
  services: ssh dhcpv6-client ftp
  ports: 20023/tcp 29000-29100/tcp 20021/tcp 21/tcp 30000-65535/tcp
  protocols:
  masquerade: yes
  forward-ports: port=20023:proto=tcp:toport=23:toaddr=10.1.1.2
        port=29000-29100:proto=tcp:toport=29000-29100:toaddr=10.1.1.2
        port=20021:proto=tcp:toport=21:toaddr=10.1.1.2
        port=21:proto=tcp:toport=21:toaddr=10.1.1.2
        port=30000-65535:proto=tcp:toport=30000-65535:toaddr=10.1.1.2
  source-ports:
  icmp-blocks:
  rich rules:

журнал отладки filezilla

Comando:    PORT 10,199,168,245,209,41
Trace:  CFtpControlSocket::OnReceive()
Risposta:   200 Port request OK.
Trace:  CFtpControlSocket::TransferParseResponse()
Trace:    code = 2
Trace:    state = 2
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::TransferSend()
Trace:    state = 4
Comando:    LIST
Errore: Timeout connessione dopo 20 secondi di inattività
Trace:  CControlSocket::DoClose(2050)
Trace:  CFtpControlSocket::ResetOperation(2114)
Trace:  CControlSocket::ResetOperation(2114)
Trace:  CFtpControlSocket::ResetOperation(2114)
Trace:  CControlSocket::ResetOperation(2114)
Errore: Non è stato possibile leggere il contenuto della cartella
Trace:  CFileZillaEnginePrivate::ResetOperation(2114)