Why could you not just fire up a 2nd instance of vsftp have it listen on the IP your sending your want/internet users to with the passive setup to use your public ip. And a second instance listen on different rfc1918 address where your local clients go.
Or as hinted upon just use a secure method of file transfer like sftp that only uses 1 port and there you go no issues, and now your secure!! And all you have to do is forward 1 port on pfsense.
ftp has been antiquated for YEARS, anyone still using it just nuts or lazy… There are FREE sftp clients for any user of any OS to use, there is FREE servers, shit any linux distro out there comes with it. You can do it on windows now for free as well.
So what could be the excuse of still trying to use a unsecure antiquated protocol like ftp?