HyperDeck Mini FTP connection issue from different subnet

HyperDeck Studio Mini with HyperDeck 6.0 Update (firmware updated),
Windows 10, FileZilla 3.42.1

We are able to connect to the HyperDeck Mini using FTP when the connecting computer is on the same subnet (AV equipment network) but when we try to FTP from the subnet our controlling computer (ATEM Software Control) is on it fails to connect. (Connections are made while not recording.)

from computer on x.x.A.x
Connecting to x.x.B.x...
Error: Connection timed out after 20 seconds of inactivity
Error: Could not connect to server
Status: Waiting to retry...

From the same computer (on x.x.A.x) we have no issue connecting the ATEM Software Control to devices in x.x.B.x, or the same attached HyperDeck Mini. We can ping the HyperDeck Mini from x.x.A.x without any issue. But FTP will not connect. Moving that same computer to x.x.B.x it can connect to FTP on HyperDeck Mini.

We have the controlling computers and A/V devices on separate subnets for security reasons to restrict access to these devices, and limit what other computers/devices in the greater network can see.

The router between these two subnets normally has rules to restrict what traffic from specific devices is passed but completely removing these rules makes no difference. If I set up an ftp server (FileZilla server) on a computer in x.x.B.x then computers in x.x.A.x can connect to this without issue so does not seem to be a router issue.

The HyperDeck Mini has a fixed IP address (x.x.B.220) with correct subnet mask (255.255.255.0) and default gateway (router x.x.B.1).

Does the HyperDeck Mini FTP service have a restriction on connections from other subnets apart from it's own subnet of it's IP address? This seems to be the only conclusion we come to so far.

Is this by design or a bug?

Additionally, when recording 1080p59.94 H264, when on the same subnet, FTP seems to start connecting/handshaking but then seems to times out after a period. Is this a limitation due to the recorder not having enough processing power to respond fully to FTP while H264 encoding at this resolution and frame rate?

Given that there is no username and password required to access the HyperDeck's FTP server, it wouldn't be crazy if access were restricted to the local subnet (for security reasons).

The HyperDeck manual somewhat suggests that the machines need to be on the same network, but is not 100% clear on if this a strict requirement:

Connecting to HyperDeck Studio Mini
With your computer and HyperDeck Studio Mini on the same network, all you’ll need is an ftp client and your HyperDeck Studio Mini’s IP address.

I can understand why it may be restricted to the local subnet for the reasons you give.

The documentation could be clearer though. To me "on the same network" means connected to the same network and most internal networks of any size beyond home use generally have multiple subnets connected through a router/layer 3 switch.

The fact the device has a gateway setting and can be controlled by ATEM Software on a computer between subnets, why would it then need to restrict that same controlling computer accessing the recording via FTP.

If the HyperDeck Mini is limited in this way for security reasons I think the documentation could certainly be clearer.

Can anyone from BlackMagic confirm if this is by design or is some other issue/bug preventing connection?

As a subnote, my main job is network security and it still troubles me that no apparent thought is given to security for connections to most audio/visual devices (not just BlackMagic) with network capability. Which then requires network design involving subnets/VLANS/firewalls to restrict access to such devices making this behaviour of the HyperDeck Mini confusing.

That's a good point about the HyperDeck Ethernet control protocol, which doesn't have any access control either.

Are you able to connect to the Ethernet control port 9993 across subnets?

Friday is the earliest I will be back on site. Will try and run some more tests then and see if I can connect to that port. And look again for any other issues that may be affecting any connection.

I have been able to do more testing.

From the same subnet as the HyperDeck Mini was able to connect to the ethernet control port and send commands to the device,

From Windows 10 Laptop on WiFi (no firewall enabled on laptop)
subnet [192.168.30.0]
ncat 192.168.30.220 9993
am able to get a connection, send commands and receive responses

Moved the same laptop to the other subnet [192.168.0.0] (WiFi, different access point)
>ncat 192.168.30.220 9993
Ncat: .

>
no connection is made and no response is received.

The Atem Software Control application still works from either subnet on the same computer connecting to the Video Switchers and HyperDeck Mini.

Also tried our main control computer which is connected by cable on subnet 0.0 and got the same result with ncat. No response.

Have gone through the router config and firewall rules again. And turned off/disabled all rules and NAT to allow all traffic through from the one subnet to the other and it does not appear to make any difference.

Having access to the ethernet control port across subnets would be useful functionality to have.

It is possible the issue still lies in the router and connected switches (consumer grade) and I am missing something. When I get time I want to bench test again using the new layer 3 switch we have and see if it makes a difference. We are intending to permanently install this switch soon for all the AV equipment (waiting on cabling work).

This appears to be a bug in the v6 Hyperdeck software so far as I have been able to figure out. If you downgrade the software to the last build in the v5 stack, it should work across subnets. I believe that the network stack is ignoring the gateway, but have been unable to prove that.

Can confirm that v6 will not traverse any form of layer 3 routing.