Servers sent passive reply with unroutable Address

Dear support team,

I get an error

Server sent passive reply with unroutable address 10.0.0.4 using host address instead
Inside error reads
SSL3 alert write: fatal:decrypt error
digest check failed
TLS connect: error in error
Cannot establish TLS connection
Copying files from remote site failed

I have created in my firewall a separate rule with destination port 62990 and removed any kind of inspection to avoid encryption errors. Policy matches the traffic but I still have same mistake
Also from time to time after 5–10 tries the connection is established (although file copy fails).

Please start here:
https://winscp.net/eng/docs/ftp_modes#passive