For a VIP is port 8008 internal closed and external opened

On a Fortigate 200D a VIP (Virtual IP) is created.

  Type NAT

  Source Address Filter: off   Port Forwarding: off   One external IP-address

  One Mapped IP-address

The Mapped (internal) IP-address is used by a Linux system with only port 22 (SSH) open. So port 8008 is closed.

From external (on the external IP-address) it is possible to login, with SSH, on the internal Linux system. From external (on the external IP-address) port 8008 is open. From external (on the external IP-address) it is possible to connect to port 8008.

But the end-point of the connection to port 8008 is not the internal Linux system. The program "nmap" shows (from out-site to the external IP-address) the lines below:

    Port     Protocol  State  Service  Version

    22        tcp           open   ssh          OpenSSH 7.2p2 Ubuntu 4ubuntu

    8008    tcp           open   http        Fortinet FortiGuard block page

So is seems that the end-point of a connection from external to port 8008 is the FortiGate and not the internal Linux system.

How is that possible?

How can port 8008 be closed from the external internet?