Let's assume that my public IP address is
A.B.C.D and I have a Linux server within my network that has the IP
X.Y.Z.T and I have some port open in the
X.Y.Z.T server but that same port is closed in my main router so that
A.B.C.D:PORT can not be reached from an outside network.
The thing is that I have been attacked by someone that exploited my resource at
X.Y.Z.T:PORT by accessing it through (according to my server's logs)
A.B.C.D:PORT cold not be accessed from outside my network since the port is closed and the attacker's IP has no NAT address inside my network. So my question is how can something like this happen ?
Please understand that I don't expect a full answer to that, I just need some clues where to start looking (I'm a complete beginner in networks).