Hello,
I am using two mikrotik routers one as ftp server, the second as a router. The server is at public ip. What I am trying to do is to use fetch command to download some files from ftp server.
If I use following command via wan interface, the file is downloaded successfully.
/tool fetch address=$ip src-path=$dst user=admin mode=ftp password=password dst-path=$dst
However when I route the traffic to vpn tunnel I am not able to download the file.
As I searched a little bit deeper, the connection is established, user is connected to the ftp server and in firewall filter rules I see that the server is getting data at the input and
also is responding at the output from port 21. The problem is I don’t receive that data on the router side, not even able to see incomming traffic in firewall rules. After 10 seconds
router is kicked from server by timeout. (Using the latest version of routerOS 6.39.2)
I am using fetch command the same way for https, routed to vpn tunnel and this works correctly.
The firewall is the first place I’d look. Make sure you are allowing port 20 inbound on the client side. I’ve never used the MikroTik FTP implementation but their wiki page seems to indicate they use L-1 (20) for data. By default the FTP server will try to connect back to the client (active). I’m not sure if the MikroTik server supports passive FTP and if so what ports need to be opened on the server side for the client to connect into.
I suppose I could turn FTP on and do a little poking around … Ahh the protocol that hates NAT so dearly.
I have allowed port 21, also tried with port 20 to see if something is going through. Outbound 21 is working perfectly, just not receiving data.
I checked the traffic in Wireshark and after 3-way handshake it jumped to passive mode.
The strange is that via wan it is working perfectly, not working just via VPN.
http://imgur.com/a/jSWqM
Screen from wireshark entering passive mode.
Solved by entering internal ip address of tunnel instead of public ip to the fetch command 
Gotta love the simple fixes.