When you initially connect to ftp, the client hig port connects to ftp server port 21. If the user want to move a file or do a listing, the client provides a port and the server creates a data connection, connects from server port 20 to client specifed (high) port. This is one of the only places a specified port is used as a tcp client. Maybe the ftp designer was afraid all ports wuld be taken, so he reserved one! It does identify the ftp activity to the firewall better than the PASV option, where a data connection is from client high port to server specified high port. So for not PASV, you need a rule that says connections from tcp port 20 or to 21 on the ftp server side are both OK.

PASV was nicer for clients inside a firewall, where all connections originate in the client and the firewall does not need ot support internal listeners, which might be hacker entry services. You need a global high port inside connect ot high port outside permission. This also allows internal clients to hit outside high port http urls, like: "http://some-not-root-http-server-host:some_high_port/"