Also, disable Universal Plug and Play (UPnP) from the router's Advanced Settings page, just in case a device is somehow being allowed to open Port 21 to the Internet.
A small note - Many routers, but not all, include port security so that UPnP cannot be used to open a "reserved" port below the number 1024.