How to hide internal network addresses in Mikrotik?

Question

Mikrotik

Hello.
There are 2 Mikrotik routers.
The first one manages all connections, there are all sorts of markings, channel division, vpn, and so on. Users connect to it.
Mikrotik address is 192.168.88.1. In his network, everyone has the address 192.168.88.10-100.
It has a default route to the second Mikrotik.
The second Mikrotik all that does is connect to the Internet and, accordingly, gives the Internet to the first Mikrotik.
The problem is this:
The second Mikrotik sees all the connections of the users of the first Mikrotik with the Internet. That is, the IP address 192.168.88.100 located in the network of the first Mikrotik accesses IP 8.8.8.8, during the call the second Mikrotik sees the entire chain. And so with all connections.
How to make the second Mikrotik see instead of 192.168.88.100->8.8.8.8 192.168.88.1->8.8.8.8?

Answer 1

Throw out the second Mikrotik from the scheme, set up routing and disguise the internal network.

Answer 2

If you leave the scheme with 2 microticks (let’s say it’s necessary), then on 1 you need to enable masquerading on 2, i.e. instead of routing, configure NAT by analogy with how it was done on router 2. As a result, 1 router will know who goes where and where, and only one address of 1 router will go to the second router. https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT
If you need to completely hide the presence of nodes 192.168.88.100, then you need to fix the ttl in the packets.

/ip firewall mangle add action=change-ttl chain=prerouting new-ttl=increment:1 passthrough=yes

Answer 3

What are the subnet masks?