Assuming that you have a public IP address, with a 192.168.x.x private subnet using dynamic NAT to translate the private IP addresses to the public IP address, there is no way for an attacker to do a port/vulnerability scan of your private subnet from the internet.
2 of 2
deleted 59 characters in body
user10211