Some advice please?

I have a small SOHO network running off a win2k server. The server is my
DHCP,DNS server and, unfortunately, my internet gateway. I am sharing my
internet connection via a demand dial interface configured via the windows
NAT service in RRAS. I have a firewall installed on the server that GRC and
Sygate scans indicate as being stealthed on all ports. My question is
derived from the fact that my firewall's traffic logs indicate that the
firewall has in fact allowed the incoming traffic from the scans (the
application is IPNAT.SYS) on the IP address of my PPP adaptor (not my
ethernet adaptor). I understand that IPNAT.SYS does the address translation
from the public IP of my PPP adaptor to the individual client IP's but I am
concerned that my firewall allows the incoming traffic on the PPP adaptor
even though there is no response traffic generated by the server to the
probe? I have experimented with rules to block IPNAT.SYS from blocking all
traffic (including traffic on the PPP adaptor) except for specific ports
required for HTTP, NNTP etc etc. and this works but is this really
necessary. Is my system exploitable by the fact that my PPP adaptor allows
rather than blocks the incoming probes (but does not respond) ?

Hamish McSporen