The server uses port 21 for incoming connections. This connection is called the "control" connection.
All commands you send and the FTP server's responses to those commands will go over the control connection, but any data sent back (such as directory lists or actual file data in either direction) will go over a "data" connection. This is a seperate connection on a different port.
In "Normal" mode the client sends a PORT command, that tells the server which (random) port number to use to connect to the client. In this mode you have to open all outgoing ports for the server.
When the client uses "PASV" mode ("passive ftp"), to retrieve files from your FTP site, the clients opens the data connection to the FTP server itself on a specific port. This port number is determined by the server (via the PASV command). You can configure FTP server which ports it may use(see: Configuration). This means you'll have to open the specified range of ports for your incoming connections.
Settings for some popular firewalls:
Windows XP Firewall: http://support.microsoft.com/default.as ... US;Q308127
Zonelabs Zone alarm: Give the server full access to the internet.
Blackice: http://www.iss.net/security_center/advi ... efault.htm
Also read this very usefull information: http://slacksite.com/other/ftp.html for more information about PASV and PORT mode.
For more information how to configure you type of router please check out this website: http://www.portforward.com/routers.htm
This site is dedicated to port fowarding and has detailed descriptions for almost every router on the planet.