Most of thoses little firewall devices allow port forwarding or redirection. Some also allow a machine to be defined as a server, I assume this means all ports get redirected to it.
For thoughs who don't know what the diff between a standard FTP and a Pasive FTP connection
Normal
1 - Client contacts server on 21 (control channel)
2 - Client logs in
3 - Client issues PORT command requesting a data chanell, the server responds with the port number (often random or from a pool).
4 - Client issues other commands....
5 - Client issues file transfer/ directory list or other command that requires data transfer
6 - Client connects to the port given by the server in 3
7 - Data is transfered, often the data chanell is closed again (but left reserved for more connections)
8 - etc...
Pasive
1 - Client contacts server on 21 (control channel)
2 - Client logs in
3 - Client issues PASV command with a port number as a paramater (often random or from a pool, this is only the clients side). The server responds with an acknologement (or not).
4 - Client issues other commands....
5 - Client issues file transfer/ directory list or other command that requires data transfer
6 - Server connects to the port given by the client in 3
7 - Data is transfered, often the data chanel is closed again (but left reserved for more connections)
8 - etc...
As you can see the only change is the direction of the data chanel, most firewalls will allow outgoing connections but not incomming connections (unless open port). A firewall that will allow PORT need to be monitoring the control chanel for PORT commands, and most don't.
There is one other way to allow standard FTP, as the data ports are always >1024 many firewalls leave the high ports open.