VM will not block port 21 on only one of thier IP's. If the direct laptop to modem (bypassing the local address) worked then 90% sure it's the router or a firewall issue with the local address.
If you want further proof try each machine on the modem only and I'll bet each one gets through
