In active mode, the server connects to the client to open data connections,
which won't work if the client is behind NAT. I added an ActiveListenAddr
config field to control what ip/port goftp listens on for the active
connections, but the default behavior of using the control connection's ip/port
should be sufficient in most cases.

I wasn't able to get TLS working with active transfers. I don't think proftpd
or pureftp support it. Proftpd has SSCN to enable secure file transfrers and
actually has code to establish TLS connections as the client, but it just
errored out for me (and I think it's different from FTPS anyway).

If you specified a TLSConfig in the goftp config, goftp still enforces that the
active connection is TLS, so TLS with active transfers is probably not going to
work unless the server is smart enough.