Hi, currently nf_conntrack_ftp module is not loaded, that mean that opening port 21 is not enough, because we are not able to do datas transfert, or we need to open a lot of ports. I think it should be great to load nf_conntrack_ftp by default. (maybe they are also other protocol where conntrack helper is usefull)