ftp on DMZ problems

[Bryan Irvine <bryan.irvine@kingcountyjournal.com>]

I was having some problems with my FTP server (running OBSD) behind a
firewall (OBSD running pf), in that whenever I had my pf rules tightened
down, the ftp server would take a _really_ long time to bring up the
authentication window.  A look at the pf logs reveals a reverse ip-name
lookup by the FTP server immediatelly after the connection is made. 
When I use a pass in all/pass out all rule, it works just fine, but I
can't leave it like that.  I had to edit resolv.conf to disable remote
lookups.  Any ideas?  I am using a pass out all keep state, so that
should allow the name lookup to get back in once the request was made
right?

--Bryan