The IP address shown in oned.log are the IPs of the hosts which perform the request. So what you see in the log are not request to external IPs they are request from external IPs.
So this is very strange because I have nebula running on local network and even though there is a gateway, there is no NAT or routing from public WAN to my lab machine. How are they able to get to my nebula instance ?
Is nebula establishing some kind of tunnel on startup ?