Ultimately what I want to do is connect a second physically separate gateway, and assign its WAN port one of the public IP addresses given by our ISP.

So I have the following setup currently and is working.

  1. Fibre leased line from ISP.
  2. Fibre comes to ISP box
  3. Ethernet from ISP box plugs into pfSense WAN port
  4. pfSense WAN port set as static IP assignment IP: xxx.xxx.xxx.99, GW: xxx.xxx.xxx.98/30
  5. Add one of the public IP addresses as a virtual IP address in pfSense IP: xxx.xxx.xxx.105/29
  6. Create a new private network and assign it to a spare ethernet port IP:
  7. Connect the second gateway wan port to pfSense and assign the wan a static IP:
  8. In pfSense setup 1:1 NAT and outbound NAT to connect all traffic xxx.xxx.xxx.105 <- between->
  9. Setup firewall rules in pfSense to allow all traffic between WAN xxx.xxx.xxx.105 and LAN

While this works and the new device talks over the public IP address, the actual gateway thinks it's public IP address is, not xxx.xxx.xxx.105. This make configuration of VPN serves impossible for me as the device is wrongly thinking its public IP is a private one.

To clarify, which is my understanding, I might be wrong, the ISP gateway is xxx.xxx.xxx.98 on a /30 network and have given us a /29 block of IPs that are routable through xxx.xxx.xxx.98/30. From my testing the above rules out being able to connect a switch between the ISP box and pfSense WAN and just assign devices those public IPs of the /29 block.

Is there any way I can configure the WAN port on the secondary device with the public IP address, connect it to pfSense someway and just get pfSense to route it out to xxx.xxx.xxx.98?

  • The .98 and .99 address are in a /30 network that connect you to the ISP, and the /29 is another network, routed on this link by your ISP, is it right?
    – JFL
    May 9, 2017 at 14:50
  • @JFL exactly that.
    – Scott
    May 10, 2017 at 10:47
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Sep 7, 2017 at 17:11

2 Answers 2


I found my answer in the pfSense The Definitive Guide Version 2.1.

Small WAN IP subnet with larger LAN IP subnet

Some ISPs will give you a small IP subnet as the "WAN side" assignment, and route a larger "inside" subnet to your end of the WAN subnet. Commonly this is a /30 on the WAN side, and a /29 or larger for use inside the firewall. The provider's router is assigned one end of the /30, typically the lowest IP, and your firewall is assigned the higher IP. The provider then routes the LAN subnet to your WAN IP. You can use those additional IPs on a routed interface with public IPs directly assigned to hosts, or with NAT using Other VIPs, or a combination of the two. Since the IPs are routed to you, ARP is not needed, and you don't need any VIP entries for use with 1:1 NAT. Because pfSense is the gateway on the OPT1 segment, routing from OPT1 hosts to LAN is much easier than in the bridged scenario required when using a single public IP block. Figure 10.25, “Multiple public IPs in use — two IP blocks” shows an example that combines a routed IP block and NAT. Routing public IPs is covered in the section called “Routing Public IPs”, and NAT in Chapter 11, Network Address Translation.

So I made a spare interface OPT1 and assigned it one of the public IP addresses. Hung a small five port switch off OPT1 and plugged in my servers to it. The servers were then assigned a public IP address with the gateway set as the IP of OPT1. With this, I had to sacrifice one of my public IPs but I was able to directly assign a public IPs to servers on OPT1. At the same time, I was able to continue to use the rest of the spare public IPs as I did before with 1:1 NATs through to servers sat on the private LAN.

The rest of the setup was just setting up firewall rules to allow OPT1 <--> WAN.

enter image description here

UPDATE: Another step that is needed, is that any automatic outbound NAT rules need to be deleted for your public IP block. If they are not deleted the outbound NAT rules will make the public IP's go out as your WAN public IP rather than their own IP.

As noted in the manual here: https://docs.netgate.com/pfsense/en/latest/interfaces/using-public-ip-addresses-on-an-interface.html

  • If you execute curl -s http://ipecho.net/plain from host, will it return or May 28, 2020 at 4:40
  • @ChauCheeYang I know why you ask this as there is another step you need to follow for the OPT1 interface to go out on its public address rather than WAN address: docs.netgate.com/pfsense/en/latest/interfaces/… You need to delete the automatic outbound NAT rules generated for your public address block.
    – Scott
    Jul 26, 2020 at 13:22

On your step 5 you assigned IP: xxx.xxx.xxx.105/29 to your VIP. That IP address is not in your allocated IP range assigned by your ISP. You have the WAN port configured as x.x.x.99/29 and its gateway as x.x.x.98 which means if its /29 then your usable IP addresses should range from xxx.xxx.xxx.97 to IP: xxx.xxx.xxx.102

So in my opinion you should you one of your allocated IP range as your VIP instead of xxx.xxx.xxx.105/29

Hope this helps

  • you are assuming that the network that connect to the ISP is the /29. It may not be so.
    – JFL
    May 10, 2017 at 6:43
  • You right. Sorry I didn't read that properly. I was just doing a similar setup recently with the ISP giving me /29 May 10, 2017 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.