Lots of ports. And it chooses them as it goes.
KISS, APF, and other iptables based firewalls should handle it automatically.
If your firewall doesn't handle it you can set up a set of ports, tell proftpd to use them, and tell the firewall to allow them.
Do a gogole on: IANA registered ephemeral port range and look also for proftpd.conf configuration value PassivePorts.
What firewall are you using?
Jeff