What router is it ??
In order to make it work you have to have the passive port range forwarded as well as the regular ports. The only time Zone Alarm will come into affect is if someone you want to get in tries to. There will be a pop up asking you to give axx to serv-u daemon. Once you say yes it is good from then on on.
Now for the router. When you set up Serv-u it's kinda tricky depending on what router you are using. Either way though two things remain clear. You must forward the regular ports, and you must forward the passive ports. Having port 20 and 21 open is correct. Now you have to forward the passive ports.
When you set the ftp up you have to do a couple of things to it. Things like set the dynamic dns information, this isn't really needed, but if you don't want to give your ip out every time it changes you can do this and go to
www.dyndns.org, and get a redirect. Allow passive range with your wan ip, set the passive ports in the server to coincide with the passive ports you opened. and the major thing, do not enable dmz. Of course you probably already know that if you do that there is no point in using a router. You can use other ports instead of 21, depending on what router you are using of course. I am using netgear with mine and I am using 7007 and 7009.
If by chance you do have a linksys here is a link to help. It goes more in depth with what I said ->
http://www.linksysftp.org/. The setting work with other routers as well if you don't have a linksys. It's general information basically but affective.. Good luck and if you have any probs let me know ..