thanks for advice, I will try this, but this is not as elegenat, i want my 4 hosts on DMZ to have public adresses configured. i treat NAT 1:1 as more complicated than my desired configuration.
My configuration is more elegant and simpler but unfortunatelly pfSense has problems with advanced routing (there is no routing option at all), it is rather advanced firewall and very simple router.
I wonder (will testing) if DMZ and WAN can use the same addreses and be NATed 1:1
i mean x.y.z 195 on DMZ nated to virtual IP x.yz.195 on WAN
this will be very sophisticated and complicated but it will look like my desired configuration for hosts in DMZ.
pfSense lack routing. You have no control on routing in pfSense but You can change routing in shell.
I tried to do my routing. IT support it, You can make any of routes I described using route command, even can control proxy ARP.
but one i cannot override:
this freeBSD do not accept default route gateway x.y.z.193 on WAN (le0)
when I insert route giving -interface le0 it shows "route: bad address: le0"
when I ommit interface i got strange route
0&0xc0a800002 link#3 UCS 0 0 le2
this route is wrong because use wrong interface and is difficult to alter or delete
but when I leave original default an only make change to it
route -d change 0.0.0.0. interface le0
default 00:0c:29:8a:d1:f9 UGS 0 4 le0 (this is good, my gateway is on le0)
and it worked fine for few minutes (this is mac for le0 WAN interface) and then it hangs and i did not get the same result after restart
even using the same command
it looks like my configuration Is perfectly coorect buy freeBSD do not gives You full control on routing
the main problem is that my gateway is on WAN but its addres is covered by DMZ subnet
so setting this gateway as default implicit make default route on DMZ
using explicit WAN interface is not accepted by freeBSD
i think it is kind of BUG
i public this gateway using proxy ARP on WAN, so it should accept it !!!
but when i force freeBSD for correct route table i wonder what will the firewall do
Im not good in network configurationin BSD/linux
but maybe should make sophisticaed /etc/rc.conf to make routes permanent
and avoid changes made by pfsense
and wait for 1.3 release
maybe they will fix problem with traffic shaper in bridge mode (does not work in 1.2)
so then i will just bridge WAN and DMZ
it is simplest way to get my configuration