SuSEfirewall2 and ftp-data port

Hi List, Does anyone know how SuSEfirewall2 works with ftp-data port? I need active ftp from firewall host, and I have to set FW_ALLOW_INCOMING_HIGHPORTS="ftp-data". In this case active ftp works, but SuSEfirewall2 allows incoming connections from port 20 to any high TCP port. If it works this (insecure) way - what is kernel module ip_conntrack_ftp for? -- Thank you, Vadim Kouzmine