How to NAT behind a single public IP (DIA) without 2nd router?

Started by ciarlill, November 11, 2024, 04:54:27 PM

Previous topic - Next topic
I just had a DIA circuit installed at my home and I was given a block of 5 public IP addresses. Currently I have everything working but the router's WAN IP is not one of the public block I was given and it does not properly geolocate me. I don't really _need_ these public IPs but ATT just provides them. At some point I may utilize them as I build out my network but currently I just want to NAT my basic consumer devices behind one of these public IPs with correct geolocation.

I tested out creating a new OPT1 interface which uses the public IPs and skips outbound NAT. This works fine for a single device plugged into the OPT1 interface. My issue is that it appears that I can only configure DHCP for the other 4 addresses in the range. I want to put my whole 192.168.1.x network behind one of these addresses. Is there a way to do this without introducing another downstream router?

Config notes:

WAN Gateway IP: 12.xxx.yyy.49
Router WAN IP: 12.xxx.yyy.50/30 (static IPv4 configuration)

OPT1 Static IPv4: 12.zzz.ooo.17/29

Firewall rule: WAN interface, source: 12.zzz.ooo.16/29 NO NAT


You can add the additional addresses to the WAN interface using virtual IPs. Then, adjust your outbound NAT rule(s) to use the desired virtual IP.

Cheers
Maurice
OPNsense virtual machine images
OPNsense aarch64 firmware repository

Commercial support & engineering available. PM for details (en / de).