Gateway MAC filtering (Parallels Remote Application Server Console > Farm > Gateway > Gateway Properties > Security) does not work for external users
Gateway MAC filtering feature is related to which devices can actually communicate with the gateway, no payload data is used and the MAC is resolved via ARP. The feature is intended for local connected devices on the LAN. Thus if router is on the front, only router will be received.
To filter by MAC irrespective of the path taken to connect to the system you need to use the filtering within the publishing items or configure Mac filtering on the routers.