Clients IP

Why is client side ip showing in Touch?
This my set up,

PPPoE IP to Client: 10.10.10.10 >>>CPE NAT>>> Client side IP: 192.168.1.1/24

When running touch on the client interface their ip shows up
i have tried this rule: /ip firewall filter add chain=forward connection-state=invalid action=drop
but its stills shows up.
Please is the normal, if not how can i stop it?

Some one should please advice

You running Torch on your WAN interface? Mine shows the IP address of the wan public IP. In IP > Firewall > NAT you should have a masquerade rule for your wan interface. This is the out-of-box config and if your internet works, then the masquerade rule must be there.

If you’re using IPSec, the private IP will show, encapsulation happens after routing.