All Traffic Seen as Gateway IP by cphulk

Hello, After investigating some of your run-of-the-mill cphulk blocks, I realized the reason my whitelist isn't working is that cphulk is seeing all traffic as the gateway IP (10.0.0.1) and brute forcing bots are getting that IP temp banned. Clearly I've taken a wrong turn somewhere in configuration if cphulk is seeing everyone as the gateway's IP. Could anyone lend any insight? I've checked /scripts/cpanel/cpnat and it looks correct as "10.0.0.3 {correct ext IP}". I've run /scripts/build_cpnat and see the same with "info [build_cpnat] 10.0.0.3 => {correct ext IP}". See attachment for example of gateway IP showing in cphulk.