ipf and/or ipnat question

[John Abbott <jabbott_(_at_)_abbotts_(_dot_)_org>]

Hello all,

I am running ipf and ipnat to protect four servers.  Three machines that I would only want a limited number of places to be allowed to ftp in, the other machine runs anonymous ftp so I thought I should have ipf.rules setup like this:
pass in quick on fxp0 proto tcp/udp from any to 206.9.120.200 port = 21

In ipnat.rules I have:
map fxp0 192.168.1.10/32 -> 206.9.120.200/32 proxy port ftp ftp/tcp

and later on in ipnat:
rdr fxp0 206.9.120.200/32 port 80 -> 192.168.1.10 port 80
rdr fxp0 206.9.120.200/32 port 22 -> 192.168.1.10 port 22
rdr fxp0 206.9.120.200/32 port ftp-data -> 192.168.1.10  port ftp-data
rdr fxp0 206.9.120.200/32 port ftp      -> 192.168.1.10  port ftp

But when I try to connect I get logged in but when I do an ls I get:
ftp> ls
200 PORT command successful.
425 Can't build data connection: Connection refused.

Any suggestions?

--ja