I have been trying to debug this issue for a while now. What we see is that sometimes, only sometimes ACTIVE ftp from client get "425 Failed to establish connection" from our vsftpd server. I turned on verbose logs and saw that when vsftpd server is trying to connect back to client for eg: from port 20 -> 50502 on client's machine it just times out. I came accross the following link:
Then I checked /etc/init.d/iptables status and it says firewall is stopped. I did iptables -L and don't see any rules. Do you think it's worth adding ip_conntrack_ftp and some other things that above URL is talking about for tcp/ip connection.
I also ran script that logs netstat output and it looks like it sends SYNC_SENT and then is not able to ESTABLISH connection. Earlier I thought that it could be a PORT issue on client side but sometimes connection is successful on the same port that failed before, so I don't think it's a problem on client's side. I was thinking that may be adding ip_conntrack_ftp would be a good idea.