We use zmap to port scan remote devices within our network. The devices have a "WAN" port which is basically where the public IP is configured. Then the other ports are on the natted/inside private network. Since we are scanning the public IP which sits on the "outside" interface, is it possible for the scan to pick up a port-forwarded service listening on an inside interface? For instance, I scan the outside interface for something listening on UDP port 67. If the remote user has port 67 forwarded to an internal DHCP server, should I expect my scan to pick that up as an "open" port, even though its technically not on the outside interface?
Yes, you should see it as open, if the port on the WAN side is natted to the internal network and the internal server can route back out the nat device.
On a normal FW where nat is setup for internal traffic connection out through the FW the ports will not be open, only for the external device connected to.