Can connect to FTP, but cannot complete the connection unless unsecure

[Farfy]

My setup:
Using Amazon Web Services, I have a server that only hosts ftp. We were using plain FTP previously but now we want to use FTPS. When connecting using plain FTP, everything works. When connecting with FTPS, it will establish the connection but then throw a 'failed to retrieve directory listing' error.

In AWS, I have the following ports open:
55000-65000

989-991

20-22

Same ports are open in Windows firewall

What am I missing that it can't grab the directory listing??

[botg]

What does it say in the message log?

[Farfy]

(000106)7/13/2020 10:25:01 AM - (not logged in) (209.*.*.*)> AUTH TLS
(000106)7/13/2020 10:25:01 AM - (not logged in) (209.*.*.*)> 234 Using authentication type TLS
(000106)7/13/2020 10:25:02 AM - (not logged in) (209.*.*.*)> TLS connection established
(000106)7/13/2020 10:25:02 AM - (not logged in) (209.*.*.*)> USER firetest
(000106)7/13/2020 10:25:02 AM - (not logged in) (209.*.*.*)> 331 Password required for firetest
(000106)7/13/2020 10:25:02 AM - (not logged in) (209.*.*.*)> PASS ********
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 230 Logged on
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> SYST
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 215 UNIX emulated by FileZilla
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> FEAT
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 211-Features:
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> MDTM
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> REST STREAM
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> SIZE
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> MLST type*;size*;modify*;
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> MLSD
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> AUTH SSL
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> AUTH TLS
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> PROT
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> PBSZ
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> UTF8
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> CLNT
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> MFMT
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> EPSV
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> EPRT
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 211 End
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> PBSZ 0
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 200 PBSZ=0
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> PROT P
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 200 Protection level set to P
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> PWD
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 257 "/" is current directory.
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> TYPE I
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 200 Type set to I
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> PORT 10,0,3,142,255,238
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 200 Port command successful
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> MLSD
(000106)7/13/2020 10:25:02 AM - firetest (209.*.*.*)> 150 Opening data channel for directory listing of "/"
(000106)7/13/2020 10:25:12 AM - firetest (209.*.*.*)> 425 Can't open data connection for transfer of "/"

[botg]

The client you are using isn't configured correctly. It wants to use active mode, but hasn't been told that it sits behind a NAT router so it uses the wrong IP address.