This was causing me some headaches so here is the proper solution:

First of all: you need to open the firewall so FTP is not blocked anymore, besides port 20 and 21 you need also a lot more for passive connections, so either you open the firewall for all TCP connections, which isn´t a good idea, but you can limit the ports used by vsftpd with the following config parameters:

pasv_min_port=10000
pasv_max_port=10024

After that open port 10000 till 10024 in the instance security configuration.
And last but not least you need to add this directive and replace x.x.x.x with your external IP:

pasv_address=x.x.x.x