How to expose my FTP server to the world from behind NAT?

Question

There's vsftpd server in my LAN; there's a hypothetical client machine in another subnet, who can't make direct connections to my FTP server; and there's a router between 2 subnets, actually VPN.

I don't have access to the router, so I can't do port range stuff with iptables.

OpenSSH server is running on the client, so I can forward individual ports. Also, I can connect to any port on the hypothetical FTP client. So I thought, I could forward the control port 21 to the client and make vsftpd connect directly to the client for data streams (active mode). But vsftpd says 500 Illegal PORT command, probably, because the ip address reported by the client differs from the ip of the connection made by ssh to the port 21.

1 2015.03.30 14:28:24:0263 0015|->PWD
1 2015.03.30 14:28:24:0279 0016|<-257 "/okimftp" is the current directory
1 2015.03.30 14:28:24:0279 0000|->PORT 10,3,2,9,223,67
1 2015.03.30 14:28:24:0279 0000|<-500 Illegal PORT command

So maybe I need some FTP proxy on the client machine, which would modify addresses in the control commands (for active mode) and either have its own backend in my LAN or control the ssh session to create additional port forwards (for passive mode)

Answer 1

Solved with a pair of 3proxy.

backend 3proxy.cfg in my LAN:

auth iponly
# only allow connect to control or ephemeral ports on FTP server
allow * * ftp.company.org 21,30000-65535
socks -u

tunnel:

ssh@client.net -R 0.0.0.0:1080:localhost:1080

frontend 3proxy.cfg on client:

auth iponly
# allow host names that are resolvable only remotely
fakeresolve
allow *
# chain FTP proxy to parent Socks5 proxy with remote resolve
parent 1000 socks5+ 127.0.0.1 1080
ftppr -p2121