Eu encontrei a solução! Sob a rede do google cloud não é possível estabelecer uma conexão ftp ativa com um servidor ftp externo.
The big problem is that when a client program is using network address translation to hide behind a routing device on an internal network, when using PORT the client tells a server on the external network to connect to an address on the client's internal network. I.e., from the example above:
Client: PORT 192,168,1,2,7,138
A solução:
The solution depends from the network administrator of the client network to use high-quality network address translation software. Devices can keep track of FTP data connections, and when a client on a private network uses "PORT" with an internal network address, the device should dynamically rewrite the packet containing the PORT and IP address and change the address so that it refers to the external IP address of the routing device. The device would then have to route the connection incoming from the remote FTP server back to the internal network address of the client. I.e., from the example above we had:
Client: PORT 192,168,1,2,7,138
When the packet containing this PORT reaches the routing device, it should be rewritten like this, assuming the external address is 17.254.0.26:
Client: PORT 17,254,0,26,7,138
The remote server would then attempt to connect to 17.254.0.26:1930. The routing device in this example would then forward all traffic for this connection to and from the client address at 192.168.1.2:1930.
Mais detalhes aqui
Não sei se no ambiente do google é possível esse tipo de solução.
A única solução encontrada para o google cloud (por agora): para hackar o cliente ftp (no meu caso é simples: ruby) forçando o envio do endereço da rede externa real no comando PORT PORT.
Outras soluções melhores são bem vindas!