Since FTP(S) uses at least one secondary port for data connections, one or more additional ports have to be opened in the firewall.
So a good solution is to define a limited (and constant) port range for all FTP data connections and open these ports in your firewall. Typically you can define these ports in the FTP server configuration.
For further information on the FTP protocol and firewall requirements have a look here and here.