I was using torch to look at bandwidth and noticed that the 2nd router in my chain is being pinged by an outside public ip address. The address of my router that it’s pinging is a private IP of 10.x.x.x. How exactly could this be happening?
Do you have any dstnat rules enabled on your firewall which might be forwarding traffic through to your second router?
None.
Are you torching your LAN or WAN interface on your router? When I torch my WAN interface on our border router DST and SRC always seemed reversed with DST showing the router address, and SRC showing the remote hosts.
Am I correct to assume you have a srcnat masquerade rule active on your WAN interface?