Assuming that you have a public IP address, with a 192.168.x.x private subnet using dynamic NAT to translate the private IP addresses to the public IP address, there is no way for an attacker to do a port/vulnerability scan of your private subnet from the internet as he will have no idea what your private IP addresses are.