I have noticed in my firewall logs some blocks on the WAN interface using a public IP address from various private IP ranges from the 10.0.0.0/8 or 192.168.0.0/24 subnets, typically hitting common known ports but typically port 445 (SMB) but other well known ports as well. The scans happen at various hours and judging from that the private IP will hit my WAN IP with a few different ports then disappear I assume these are all automated scans.

My questions are 1. I was always under the impression that private IPs are non-routable but some how they are hitting my internet facing interface with a public IP, how is someone able to do this? 2. What is the purpose of using those IPs to try and connect to my WAN IP, I am guessing in some attempt to bypass my firewall?