Pfsense - Single IP Subnet on WAN - How?

I’m trying to replace a Cisco RV325 Dual WAN Gigabit Router with pfSense for a client network. They have a /28 publicly routable IP subnet. The current setup is that there is 1 WAN interface on the Cisco and 1 ‘DMZ/WAN2’ interface.

Example: (obviously this isn’t actually their public IP address. ) - Network - netmask - broadcast - usable – WAN on Cisco/pfSense – ISP Gateway – PBX (Statically assigned on device, I can’t change this one.)

The Cisco’s ‘DMZ/WAN2’ interface if you turn on DMZ I can just allow - to just be passed through on that port, so any device I have downstream on that interface I can statically assign a public IP in the available range and it just works.

With pfSense I bridged the WAN & OPT1 interfaces and the PBX can’t get out on the internet. I’ve tried using this page from the docs as a guide but there’s something that I’m missing some where.

Do I have to just waste a public IP to assign to the “CARP VIP” I don’t understand how that the VIP helps with the box that’s connected to OPT1 interface.

I Also looked at an actual DMZ following Jim’s video from the Netgate YT channel. per his notes on the slides you have to have a separate publicly routable subnet to assign to the DMZ or you have to do 1:1 NAT where your “DMZd” devices have a private IP and then just 1:1 to an available Public IP. I only have a single public subnet.

Does anyone know how to accomplish this? I feel like there is something that I’m missing, I thought this would be an easier problem to solve. Any help would be greatly appreciated. Thanks.

Based on the diagram, yes you need the IP. Personally not a fan of this design, but if you can’t put a private IP on the PBX behind a NAT on the firewall I guess that’s what you have to do. I assume at least you can still apply ACLs for reaching the PBX.

Thanks. Ok so can you explain where do I assign the CARP VIP? Which interface does it need to go to? What the diagram shows it what I need to accomplish I just don’t know what to set inside pfSense to make that happen.

The CARP IP looks to go on the WAN interface and then you create a NAT on the WAN interface to direct all traffic going to to forward to Try that and let me know if it works.