I happen to work on addressing this particular problem atm. Your problem is very likely caused by the deprecation of automatic conntrack helper assignment in recent Linux kernels, meaning that TCP traffic to port 21 is not handled by the nf_conntrack_ftp
helper by default anymore.
OpenWrt/LEDE's firewall3
utility is not yet updated to deal with the new helper requirements so you need to introduce a custom rule in the meanwhile.
In /etc/firewall.user
, add a new iptables rule to tie TCP/21 traffic to the FTP helper:
iptables -t raw -I PREROUTING -p tcp --dport 21 -j CT --helper ftp