In passive mode, the data connection is initiated by the cleint, so it is likely to be the firewall on the server which is too strict.

I'm too sure about the "Firewall" => ""; I'm not sure whether a blank proxy name acts the same as no proxy; you might want to comment out that line and see if it makes any difference (but it probably won't).

A final suggestion would be to use sftp if possible - it's a lot more firewall friendly!

Dave.