Would it not be easier to switch off ssh forwarding on the ssh server? Just change AllowTcpForwarding from yes to no in your /etc/ssh/sshd_config. If this doesn't suit, you could try something along the lines of
iptables -A OUTPUT -o eth1 -p tcp --cmd-owner "sshd" -j DROP
In Passive mode, when the client wants to get a file from the server or send a file to the server, the FTP server will pick a random port and send that port to the FTP client.
When you're not using encryption, a properly configured firewall (using the ip_conntrack_ftp helper kernel module, which may be what you're missing for non-TLS connections) would "listen in" on the connection and mark these connections as RELATED. With encryption the firewall can't listen in.
The quick and dirty solution to this is to configure the FTP server to choose a small range of ports for passive connections, and then allow access to all of these ports. For instance, in vsftpd:
pasv_min_port=12000
pasv_max_port=12049
Then in iptables:
iptables -A INPUT -p tcp -m tcp -i eth0 --dport 12000:12049 -j ACCEPT
Allowing anyone to access these ports opens one possible exploit: if someone were to be scanning them over and over they might get lucky and be able to "beat" the real user to the data port and grab the file. Ideally your FTP server would check and make sure the connection is coming from the same place as the original connection, but thanks to things like "FXP" (transferring files from one server to another server by convincing one to make an active connection to the other's passive data port) some servers don't check the connection by default. You should check your configuration file and see if there is an option to disable FXP, and use it. (vsftpd calls this "promiscuous" and is disabled by default.)
Best Answer
After you apply the rules that heikogerlach showed you, here's a useful link to help you in the future so you understand what you're doing.
Basically, to answer the question you posed in a comment, you need this rule:
so that incoming packets that are a response to a packet sent by your system will be allowed in. Otherwise this box won't be able to receive anything except to port 80.
NOTE: You also have to tell us something additional ... Do you want to block all access except incoming and outgoing web, or only incoming or only outgoing? What traffic do you want to allow?