Firewall – OpenBSD/FreeBSD Firewall w/ GUI that is compatible with Intel 82574L Gigabit LAN NICs

One of the Cisco 55xx series ASA hardware firewalls should be what you're after.

You should probably have a good look through their various specifications and choose the one that gives you the right feature set. (It's difficult for me to do this, not knowing your exact set up currently). Also choose one which will give you room to expand in the future.

If I had to guess, I'd say to choose the 5520 or 5540 models..

If you want High Availability, you'll need 2 of these, that support Active/Standby configuration. This is supported by models 5520 and above.

You might be able to save some money by having the DMZ ports on a VLAN which is then distributed by a managed switch. That way, you could trunk multiple DMZs traffic over a single port, with a virtual interface (You could do this on your FreeBSD box too, might save you having to have a quad port server NIC.) [YMMV on this bit though]

By default FTP uses so called 'Active' mode for data transfer which is not very firewall friendly. In this mode FTP server connects to IP:port specified in PORT command sent by client (82.103.140.25:58627 in your case).

Simplest way to fix this is to switch from 'Active' to 'Passive' FTP transfer mode. In case of 'pkg_add', which uses fetch(1) for file retrieval, it is done by setting environment variable FTP_PASSIVE_MODE.