Unable to connect the filezilla ftp server, returns error 421 Login Incorrect

It's difficult to help without seeing logs.

But my wild guess is that the working clients use different (possibly active) transfer mode than the non-working (passive).

You will get a better answer, once you share the logs.

I suspect you are using Active FTP. Active FTP requires that the client be able to listen on an incoming port. A service like CanYouSeeMe is probably configured to support this, automatically opening the incoming port when needed. However, if your client is behind NAT (that is different from your server's NAT) then the client will not be able to use Active FTP because the port that the client needs to listen on will not be forwarded from the NAT router.

To avoid this problem, you need to use Passive FTP. Passive FTP has the client initiate both connections. This means that the client doesn't need to mess around with incoming firewall rules or NAT port forwarding. However, it also means that you need to open at least two ports on the server side: the FTP command port (21) and one or more FTP data ports (which can be anything above 1024) and then tell the server to use those ports for data. These ports need to be both allowed in the firewall (when you have it enabled) and forwarded through the NAT (unless your server is running in the NAT DMZ, in which case all unexpected traffic is forwarded to it but you really should turn the firewall back on).

This page isn't the best explanation of active and passive FTP, but it does talk about configuring IIS for passive FTP so maybe it will help you: http://www.velikan.net/iis-passive-ftp/