Ahaus, if the machine is behind a true NAT, the packets get mangled before reaching your machine. This means that the IP header really reads 10.10.10.2 or something like that (at least this is what I understood from the IPTables docs and general Linux routing tutorials). That way it seems that it would truly be impossible to see the outside IP without an outside service to tell where your machines' packets come from.