In fact, in plain FTP (i.e. not FTPS) active mode often works due to some magic in many NAT
routers - they actually parse the FTP commands being sent and know what to do with the
data transfer connections. However, FTPS never works in active mode if a NAT is involved
since the NAT cannot parse the encrypted commands being sent.
Dealing with dual NATs
Unfortunately, some FTP sessions involve two NATs:
Usually, the main connection succeeds because the standard FTP port (21) is routed through
to the correct FTP server, but then the file transfers failed because the ports that they use are
not set up to forward to the server.
In this scenario, the server may be set up to only use particular ports for data transfers. The
server-side NAT may then be configured to forward these ports to the server.