I do not believe the firewall connection tracking is enabled. I have Centos 5.6 with 2.6.18-238.5.1.el5.centos.plus kernel. I went into the kernel .config and I see CONFIG_IP_NF_CONNTRACK=m. But when I do a lsmod I do not see this module. Why is this?

What happens when you?

/etc/sysconfig/iptables-config should have :

IPTABLES_MODULES="ip_conntrack ip_conntrack_ftp"

Thanks....that was it. Question though...
"# Load additional iptables modules (nat helpers)
# Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
"

Strange how the module is loaded after the firewall rules(assumeing IPTABLES and Chains) are applied. I guess it doesn't matter since this is loaded dureing boot up before a connection with an ISP is made, but wouldn't it be logical to have the module loaded before the rules are loaded?