Hello.
Please tell me, I can not understand the cause of the error. Mikrotik hAP ac router, RouterOS 6.44.4, I try to connect to FTP via an external port on port 221, the connection with TLS is excellent. I am trying to connect to the same FTP on port 21, the connection reaches the Initialize TLS stage and ends with a timeout. The default firewall after resetting to factory settings.
on Port 221?
why
To deny connection on standart 21 port. (FTP was reconfigured on 221 port)
The problem was resolve. The problem was in use a third party USB modem. Change USB modem resolved the problem.
Of course when you change the port number and want to use the default firewall you should also change the port number under IP->Firewall->Service ports.
Not. It is precisely the fact that with a default firewall, ports 21 and 221 worked with an active 21 service port (with the appropriate FTP settings). But on one USB modem, only 221 ports worked, on the other both ports. Port 21 was blocked not on internal FTP, but on the FTP contractor. I could not connect to external port 21.
The rule under under IP->Firewall->Service ports is used to temporarily open the data transfer port when a transfer is made using passive FTP.
When you do not change that, you probably can login but cannot retrieve files.
With this rule correctly set it is not required to forward any other ports than 21 or 221 for the data port, which improves security and is sometimes necessary because you do not know the data port.
Of course this does all not work with TLS. FTP does not use TLS. Maybe you use FTPS or SFTP?