Here is something strange.

I have m0n0wall setup to block private networks on the WAN, but I'm 
still seeing them at my router.

Shorewall:rfc1918:DROP:IN=eth0 OUT=pvc0 SRC=x.x.x.6 DST=10.20.31.130 
PROTO=ICMP

Looks like my m0n0wall is sending ICMP to 10.20.31.130, but it's going 
out the WAN port.  I'm guessing someone has their system setup for 
10.20.31.130 and is trying to ping something?  Why it's going through 
m0n0wall is confusing.  But it's not making it past Shorewall (I 
think).