Ok…
So with help from a modified bridging script, kindly provided by Darth Android on post http://forum.pfsense.org/index.php/topic,19231.0.html I’ve finally got a working solution.
Step-by-step instructions for those who may need them:
Install pfSense, specifying your IP connection providers settings (in my case this was a /29 subnet w/gateway IP)
pfSense: Diagnostics -> Edit File: /usr/local/etc/rc.d/wan_bridge.sh. No point in pressing load, as file doesn’t exist yet. Files in this location get run after booting, installing the bridge and reloading the configuration each time.
Paste in the script at the bottom of this post, changing the LOCAL_IFACE to your WAN adaptor and the VIRT_IFACE_MAC to something different from your WAN adaptor & press save.
pfSense: Diagnostics -> Command: chmod 755 /usr/local/etc/rc.d/wan_bridge.sh. This makes our script file executable.
Reboot.
pfSense: Interfaces -> (assign), press the + in the bottom-right of the screen to show the new adaptor (should be ngeth0)
pfSense: Interfaces -> Optional x
Enter a name, your public IP range settings (in my case a /26 subnet), an IP for the interface in this range, enable & save.
Reboot.
Setup some CARP IP’s in the public IP range.
Setup your NAT’s and rules to use WAN as the incoming interface, and specify CARP IP’s in the public range.
Manual Outbound NAT’s can also be setup, using the CARP IP’s as the translation IP address, making outbound traffic appear from your public range.
Script below, thanks again to Darth for the main body of the script. The main modification was the addition of a few lines of PHP at the bottom, which reloads the pfSense settings after setting up the bridge.
Use at own risk!!!
#!/bin/sh
#A simple virtual interface script - USE AT OWN RISK
#Creates a virtual interface and bridges it with a physical interface.
#Author: darthandroid@gmail.com
#User Variables - Modify these to suit your needs. Both need to be customized for the current system
#This is the name of the physical interface device. Look it up in `ifconfig' if you don't remember the name from when you configured pfSense
"WAN" is most likely NOT correct.
LOCAL_IFACE="eth0"
#This is the mac address of the new virtual interface. It should be different from the physical interface
VIRT_IFACE_MAC="00:00:00:00:00:00"
Non-User code
BRIDGE="bridge0"
#create the bridge
ngctl mkpeer ${LOCAL_IFACE}: bridge lower link0 || exit 1
ngctl name ${LOCAL_IFACE}:lower ${BRIDGE}
#restore packet flow to the physical interface
ngctl connect ${BRIDGE}: ${LOCAL_IFACE}: link1 upper
#create virtual interface
ngctl mkpeer ${BRIDGE}: eiface link2 ether
#set virtual mac address and bring the interface up
ifconfig ngeth0 ether ${VIRT_IFACE_MAC}
ifconfig ngeth0 up
#make sure we can read packets from the physical interface directed to the virtual one and
#that we can write packets out without the virtual mac being overwritten
ngctl msg ${LOCAL_IFACE}: setautosrc 0
ngctl msg ${LOCAL_IFACE}: setpromisc 1
#do some php and reload some stuff
echo "" | php -a
