Works:

allow tcp from any to any established
allow tcp from any to me 21000-21999 setup

allow tcp from any to me 21000-21999
allow tcp from me 21000-21999 to any

Doesn't work:

allow tcp from any to me 21000-21999 keep-state setup


#tcp services -ftp
pass in log on $ext_if inet proto tcp from any to ($ext_if) port { 20, 21 } keep state
pass in log on $ext_if inet proto tcp from any to ($ext_if) port 60000:65000 keep state