Port forwarding fails on new Untangle box

Simple enough: our Untangle box went dead, so we brought in a new PC and installed latest Untangle from ISO. And a merry old time we had setting everything up.

The issue we're having now is with FTP. The FTP server has not changed, it was not reconfigured during the outage. It's FileZilla server 0.9.41 beta, and has been working for the better part of a year without problems. It's set to passive, and requests a port in the range 6000-6100 for communication. But it doesn't matter, because we don't get far enough to touch it.

I've gone through the port forward troubleshooter. The key points are these:

• Untangle's own network monitor (Config | Networking | Port Forwards | Troubleshoot | Packet Test) sees Port 21 traffic coming in the external card.
• The same monitor sees no traffic going out the internal card.
• Connecting from Untangle works (Config | Networking | Port Forwards | Troubleshoot | Connect Test, the FTP server logs a connection attempt)
• The results are the same with the Firewall on or off.

I don't currently have console access. Trying to connect to FTP is being done from outside our network.
I have simplified the port forward to the following:
For what it's worth, the external address of the Untangle box is a static, routable IP address; the internal is static 10.0.0.10/24; there is a separate DHCP server that assigns addresses in the range 10.0.0.100 - 10.0.0.250. This used to work; I can't retrieve the configuration that worked, though, as that machine is completely dead. Clearly I'm doing something wrong; can someone please suggest where the idiocy is? Thank you.