Nmap port scan output shows (at least) 2 different things for each port: the state of the port, and the reason why Nmap decided on that state. In your output, all the ports in the filtered state are being presented together, with counts for each of the two reasons it decided on that state for each port.
Port States
A port is really just an address, and at the most basic level there are two states the port can be in: open and closed. An open port means that a process is listening and will open a connection with someone who sends a packet to that address. A closed port means that there is no process listening, and the operating system will reject a connection to that address explicitly.
There is one more state, though, and that is what your question is about: the filtered state. This is less about the state of the port, and more about Nmap's internal state: it simply can't know whether something is listening because something else is interfering with or filtering the connection attempts. There may or may not be a process listening on that port, but either way, your scanner is not being allowed to find out.
Reasons
When a TCP port is open, there is pretty much only one reason Nmap reports: syn-ack
. Similarly, when closed it is reset
. There are a few exceptions for other scan types (TCP Connect may be implemented differently on different systems, resulting in conn-refused
, for instance). But for the "filtered" state, the reason depends on what the filtering system (most frequently a firewall) does when it receives one of Nmap's probes. Most firewalls will respond in one of two ways: dropping the incoming connection without responding at all, or sending a ICMP Administratively Prohibited message. These are the two reasons that your output shows: dropped connections are no-response
, and the other are admin-prohibited
.