FTP Outbound - Retrieving directory listing fails

Hi, 

I'm missing something very obvious here and hope someone can help.

I've got a Sophos UTM with a bunch of computers behind it, one subnet, very straight forward. I've set the internal network so only HTTP, HTTPS and FTP can go out to external. 

Using WinSCP, trying to connect to FTP server on the internet it hangs on "Retrieving directory listing". If I set the rule so ANY ports are allowed from the internal to external, it works.


So i looked at the firewall log and see a range of ports up in the 60000s being dropped when i try to FTP when I set the rule back to HTTP, HTTPS and FTP only.


So do I really need to open a big range on the rule to allow FTP to function or is there a much cleaner and more secure way of doing this? I know FTP isnt secure but im more concerned internal PCs having a large range of ports to go out on.