Configuring firewall for cross-zone FTP connections

[vgaetera]

@dogtopus

Because of this I automatically think that I would need some sort of connection trackers.

You likely need it to allow #2:

https://www.jscape.com/blog/bid/80512/active-v-s-passive-ftp-simplified

Passive mode FTP

1. The client connects from a random port to port 21 on the server and issues the PASV command. The server replies, indicating which (random) port it has opened for data transfer.
2. The client connects from another random port to the random port specified in the server's response. Once connection is established, data transfers are made through these client and server ports.

But the conntrack helper rules for transit traffic should work for non-masqueraded zones by default as long as you have installed the related packages and restarted the firewall service.