An open port is an observation, not a verdict.
Open means a TCP connection was accepted during the test. It does not prove the application is healthy, authenticated, encrypted, or safe. Verify the service version and security separately.
Closed / filtered means the tool did not complete a TCP connection before the timeout. Check from the inside out: service listening, host firewall, router or cloud firewall, port mapping, public address, and ISP restrictions.
Why port forwarding sometimes still fails
The forward must point to the correct private address, the device should keep that address through a reservation, and the service must listen on the expected interface and port. If the router itself does not have a true public IPv4 address, carrier-grade NAT can prevent unsolicited inbound IPv4 connections.
Exposure has a cost. Do not expose remote desktop, databases, or administration panels directly just because the port can be forwarded. Prefer a well-maintained VPN, strong authentication, limited source access, and current software.