DPC3939B leaking RFC1918 private addresses to static IP address

I have a Comcast Business Internet supplied DPC3939B with one static IP address.

The DPC3939B replaced a 12-year old SMC device (also supplied by Comcast).  Both devices have 4 "LAN" ports.

Into one of the ports is a UNIX server with the static IP manually configured.  Egress and Ingress continues to work as-expected with the move to the DPC3939B.

HOWEVER, I also have a WiFi router plugged into another one of the "LAN" ports and it is not working properly with the DPC3939B as with the old SMC.  The WiFi router DHCP's connected devices from the DPC3939B and gets say, 10.1.10.10 with 10.1.10.1 as the gateway (ie, the DPC3939B).

The problem is when I try to access services on the UNIX server with a fully public routable static IP, the DPC3939B is not NATing the WiFi devices' packets.  INSTEAD tcpdump shows 10.1.10.10 coming INTO the public interface of the UNIX machine.  Previously the SMC would NAT these packets using its public routable address (ie, the gateway address for the UNIX machine).

How to configure the DPC3939B to stop breaking RFC 1918 and not tossing 10.1.10.* addresses to a publicly routed IP address??