But if the admin enable MAC filtering or IP filtering the router must have an open port that just let special MAC or IP for connect to it remotely. Can these ports Ability to find?
Please read this first:
https://en.wikipedia.org/wiki/OSI_modelSo, as you can see from the OSI model. MAC filtering takes place at layer 2, IP filtering takes place at layer 3, and ports operate at layer 4. Therefor, it is entirely possible for a router to not have any open ports, and still be able to route, filter macs, and other basic network-relevant malarkey.
So when you throw in a scenario where an admin logs into a device that appears to not have any open ports, that's exactly a farse. In those cases, access is allowed or disallowed via filtered ports - ports that are neither open, nor closed, they are filtered by a firewall. That's not entirely accurate either though, because a port doesn't actually listen in a "filtered" state, but rather the firewall filters datagrams depending on rulesets and sends a reject message if the datagram isn't allowed.
So if you run a scan, and it says "all X ports are closed" what it actually means is that the host 1) doesn't have daemons/services listening on the port range you specified 2) is either logically or physically inaccessible from you or 3) is up, but because you were able to resolve an address with ARP it is actually up and legitimately doesn't have any listening daemons/services listening on the network you share with it which is where the suggestions proxx gave you would came into play (vlans, ACLs, IP filtering, so on and so forth).
