How can my users discover my upstream server IP though they only connect through load balancers?

I am managing a game server prone to DDoS. I have kept the upstream IP secret and only published the addresses of 100 load balancers forwarding traffic via iptables:

echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
sysctl -p
iptables -t nat -A PREROUTING -p tcp --dport 1010 -j DNAT --to-destination MAIN_GAME_SERVER_IP6:1010
iptables -t nat -A PREROUTING -p udp --dport 1010 -j DNAT --to-destination MAIN_GAME_SERVER_IP:1010
iptables -t nat -A PREROUTING -p udp --dport 1011 -j DNAT --to-destination MAIN_GAME_SERVER_IP:1011
iptables -t nat -A POSTROUTING -j MASQUERADE

Yet, my upstream IP address has been discovered.

What about my setup could have allowed this to happen?

• None of the load balancing addresses received DoS traffic.
• The upstream server is configured to only respond to traffic from the load balancers.
• My load balancers are reachable through addresses x.x.x.20 through x.x.x.60, with the upstream server sitting at x.x.x.61.

You kind of solved the mystery in your reply to my comment: If your IP addresses can be guessed, then they can also be guessed by your less welcome users.

Public sources like certificates, previous network-scan results or simply whois entries allow one to guess which (more so if consecutively numbered) IP address blocks are managed by the same party.

As long as the service you provide remains vulnerable to whatever attack you observed, the guess can then be quickly confirmed by watching your service become unresponsive.