to simplify :
behind my Vyos i 've a LAN where are available some servers whoses providers web services.
I forwarded this web services to be available by externel client, but i configured a restrictions which authorized just certains IP public.
This point is ok, but when i scan ports the IP public’s router with a IP normally not authorized i can get the open ports tagged with “filtered”