SCAN - how does it work with Public IP

RAC DB - 6 nodes

Version: 11.2.0.3

OS: Linux 6.0

I understand that when a client tried to connect to the database, the login session will hit HOST =procrac-scan:1521(scan name),

which maps to one of these 3 IPs(11.117.90.108, 109,110), it then spawns a process to connect to one of the 6 RAC nodes(vips)

whichever has the lighter load and returns that connection back to the client.

I need to open firewall and ports and will be sending a request to networking and try to understand. I was told to send them the Public IP address as well.

Where is a need for Public IP?