The question you are asking is usually a much broader thematic from an network/sysadmin admin point-of-view, and depends on your needs, size and security policies.
Log generator solutions on your network for detecting intruders can range from:
- application specific logs;
- device specific logs (e.g. firewalls, routers, ...)
- authentication logs
- DHCP/DNS logs
- iptables logs
- Intrusion detection solutions (IDS)
- honey pots
- netflow solutions
As for collecting those logs, you usually can have:
- a central syslog server;
- a netflow collector
- solutions correlating your logs with external events (for instance IP security blacklists).
However, from your question description, I would be more concerned on firewalling/separating effectively the internal network from the Internet.
As for giving hints about specific and interesting tools in the area of security/intrusion systems, have a look at:
How PSAD detects attacks?
Detecting port scans can accomplished by sniffing packets off the
wire. This is the method used for many Intrusion Detection Systems. In
this case PSAD simply reads syslog. The syslog messages are generated
by IPTables firewall logging. The PSAD scripts parse the logs to find
relevant information and creates simple reports.
In the world of information security, the most common intrusion
detection system (IDS) you will ever encounter is Snort. As you
probably already know, an IDS works similarly to antivirus (AV)
software on your desktop; It attempts to identify malicious software
on your network and warns you of its presence.
How to Install and Configure OSSEC on Ubuntu Linux
OSSEC is an open source host-based intrusion detection system that can
be used to keep track of servers activity. It supports most operating
systems such as Linux, FreeBSD, OpenBSD, Windows, Solaris and much
more. It is used to monitor one server or multiple servers in
server/agent mode and give you a real-time view into what’s happening
on your server. OSSEC has a cross-platform architecture that enables
you to monitor multiple systems from centralized location.
Suricata is a free and open source, mature, fast and robust network
threat detection engine.
The Suricata engine is capable of real time intrusion detection (IDS),
inline intrusion prevention (IPS), network security monitoring (NSM)
and offline pcap processing.
Suricata inspects the network traffic using a powerful and extensive
rules and signature language, and has powerful Lua scripting support
for detection of complex threats.
With standard input and output formats like YAML and JSON integrations
with tools like existing SIEMs, Splunk, Logstash/Elasticsearch,
Kibana, and other database become effortless
see also The honeynet project
PS My internal network at home is completely firewalled from the outside, and the only way of getting in/using internal services (SSH/Web site/voIP/VMs/temperature sensors) is via an IPsec VPN.
If I can avoid it, I never expose web servers or SSH services to the Internet-at-large.
VNC-based solutions are also inherently insecure and not meant to be exposed in the Internet.
psad should be interesting for a small network, maybe suricata, try running your own DNS service and watch the logs