So, you used the Advanced tab on the Orbi web interface, selected Advanced Setup->Port Forwarding, and then entered the IP address of the FTP server on your internal network. Correct?
Sorry, I neglected to ask about how the Orbi is connected. Sometimes the internet modem is actually a "modem/router", which results in what people call a "double NAT". The Orbi may have forwarded port 21, but the modem/router which is in front of the Orbi may not have.
What happens when you do a trace route to 8.8.8.8?
i.e. open a Windows command window and type "tracert 8.8.8.8"?
The first line should be the Orbi itself, usually 192.168.1.1 The second line should be a "public" IP address, that is NOT a "192.168" or a "10.x"
Instead of port forwarding port 21 which is used by Orbi, please port forwad one of the free ports like 8121 to port 21 on the target device, and then use your public IP and port 8121 to connect remotely to port 21 on the target device
While it is good to have a solution, it seems a bit strange that the first (and most obvious) service that Orbi offers to forward is FTP. Why would the option exist if Orbi will refuse to do it?
Well, there's the issue. The Orbi is acting as a router creating 'private' IP addresses (192.168.x.x), but is behind another router which is also creating 'private' IP addresses (10.x) Three choices (1) put the Orbi in AP mode and create a port forward in the other router, (2) put the other router in 'modem only' mode and create the forwarding rule on the Orbi, or (3) give up.
I cverified this by configuring an FTP server on a Windows 10 machine and created an Orbi FTP rule pointing to it. Worked like a charm AFTER I dealt with Windows Firewall issues and figuring out what my "real" IP address on my phone was. (Hint: what the phone says is its IP address is not true, because the phone - like everything else in the world - is behind a NAT firewall.) This would not have been an issue except that I had set up the FTP server to allow only connections from the Orbi LAN and one outside IP address. I actually found my phone's IP address by looking in the Orbi log for what IP address was connected to my internal FTP server. Nice to see that Orbi logs that. Better have strong passwords if FTP is opened to the world (actually FTPS or TLS would be better, but I have not tried those).
If Orbi shows in the Advanced Tab - Internet Port a 10.x.x.x address, this is not the unit exposed to the Internet, any you have another device doing NAT in front of your router, or your ISP does some NAT. Port forwarding here alone wont help.
What device is connecting your Orbi to the Internet?
For using FTPES (that's the encrypted FTP, explicit security), you need to forward the passive port range configured on the FTP server manually, as the FTP ALG commonly in place on the NAT router can't assist as the control connection is encrypted.
What Firmware is currently loaded? What is the Mfr and model# of the ISP modem the NG router is connected too?
Modem Combo Units:
This would be a double NAT condition which isn't recommended. https://kb.netgear.com/30186/What-is-Double-NAT Couple of options, 1. Configure the modem for transparent bridge mode. Then use the Orbi router in router mode. You'll need to contact the ISP for help and information in regards to the modem being bridged correctly. 2. If you can't bridge the modem, disable ALL wifi radios on the modem, configure the modems DMZ/ExposedHost or IP Pass-Through for the IP address the Orbi router gets from the modem. Then you can use the Orbi router in Router mode. 3. Or disable all wifi radios on the modem and connect the Orbi router to the modem, configure AP mode on the Orbi router. https://kb.netgear.com/31218/How-do-I-configure-my-Orbi-router-to-act-as-an-access-point and https://www.youtube.com/watch?v=H7LOcJ8GdDo&app=desktop
Well, that's the reason @FURRYe38 asked about the brand and model number of the modem/router that the Orbi is attached to. Every router has a slightly different management system. Some ISP's allow the customer to access the managment interface of the modem/router, while others do not. One way to find out is to point a web browser to: "http://192.168.1.1". If it brings up a web page, then the modem/router is "visible". If there is no web page, then it may be locked.
Another way to investigate is to call the ISP technical support line and ask, "can you put my modem into "pass through mode"?
