One way ping from NS

I would say your clients should have the green interface as gateway.
And the red interface should have the address of the ISP router.

Please have also a look at this thread: