what point in the monitor output will you observe the HTTP SYN-ACK packet translated from 216.216.216.5 back into 10.10.10.5?
What rule would allow access from your local network using FTP service with User Authentication as a method of authentication?