Understanding TCP SYN ACK and discards

Could it be you're using passive FTP? FTP is one of the protocols that use more than one connection (for details see [1]). To allow FTP to traverse NATing firewalls you need connection tracking to match the second (data) connection to the first (control) connection.

You also need port 20. (FTP uses two ports) For active FTP from the server side to the client you need The FTP server will also need to talk to ports on the client >1023

Being you mention port 21, you may be runing in passive mode, but you would still need ports .1023 to be available.

All of the above is only true for active mode. In passive mode it's the client initiating the data connection, and port 20/tcp is not involved then. Instead the data connection is established from a port > 1023 on the client to a port > 1023 on the server.

cu