Depending on how stringent you firewall is, you may also need to ensure the module nf_conntrack_tftp is loaded. This will enable the data path ports. Dave !