Yes, it’s normal behaviour. They don’t see you as an especially juicy target, just another box waiting to get pwned.

Just make sure to relocate port 22, and disable password authentication (public key auth only), and that mitigates 99% of the threat surface.

Try and avoid windows or even Mac and Linux in the DMZ if possible. Put some low powered thing in the middle and run a variety of BSD on it.

BSD won’t fix all security threats, but it will force you to learn the real nuts and bolts of TCP/IP, and then confidently protect what you want to protect.

It’s like a second amendment for your network:)