Hey,
Ive seen this being posted on the forums here before, but I have yet to see a real resolution on this issue. I run hotspot and have a few clients that we use RB750’s as a SOHO Router.
Client IP (192.168.5.0/24) → [RB750] Masq → 10.x.x.x IP Address [Hotspot Router]
However what I am noticing is that on the Hotspot Router we are seeing the private 192.168.5.x Ip addresses showing up.

These users are mac authenticated and it gives us all sorts of problems at times where we have 5 - 6 attempted authentications from each client.
On the client side, they have very simple rules.
ip firewall filter
//rule to protect my management network
0 chain=forward action=drop src-address=192.168.5.0/24
dst-address=172.16.0.0/12
// rule to drop all connections inbound on 10.x.x.x network
1 chain=input action=drop connection-state=new in-interface=vlan2
ip firewall filter
0 chain=srcnat action=masquerade src-address=192.168.5.0/24
out-interface=vlan2
How can i prevent this from happening?