@PurpleOfPants: if it's that simple… For the avoidance of doubt, it is that simple. Fantastic  :-*

If you set up an outbound nat rule for it, that port forward should work.  All forwarded traffic will be seen as coming from 1.1.1.1.

Humm… why 1:1 NAT??? I (witch is just a personal opinion) think that just normal nating is better as you have MUCh more control. Secondly why do you not just us AON, and there you just say what subnet or host should be nattet out on what public IP.. THis is what i am doing here with 3WAN's with 5 Public's on each. works like a charm. Just be aware if you are not using AON and are going to switch to it MAKE Sure that the config is correct as you are saying that killing the internet would be very harmfull. Anyway hope you get this solved.

No because the proxy is the one making the outbound connection to the web server, not the originating client. Nothing you do will make that appear to originate from the actual client IP. There were some kernel hacks/patches for Linux out there (tproxy, I think) but I'm not sure anything like that exists on FreeBSD.

Very good, I will try that next. Thank you so much for your reply!

I suspected it might have been a technical limitation. I was aware of the split DNS solution but I didn't really like it. NAT reflection is what I would prefer, cheers for the tips.

ok, i will try with 2.1 Thank you

The current theory is this effect is connected with the lan being bridged to an openvpn TAP interface, even when the openvpn server has no connections.

@johnpoz: But I would again still put your private lan(s) on the lan interface of pfsense - not another wan interface. hmm, ok if i go with only 1 wan and 1 lan, wan can be internet access, and can i make lan use the gateway of the 10.100.0.X? regards

Start changing pfsense GUI from 443 to another port.

So about your first question I cant setup modem/router in bridge mode Just trying to clarify: Are you using any features of the router except for the modem? Because the router supports disabling NAT under "Basic Settings"  (however this also resets the configuration to factory default).

You are also using aliases so we cannot help verify the correct rules.

Came across your question while looking for help with my issues, if your still having problems, I wrote this, maybe it can help. http://forum.pfsense.org/index.php/topic,54800.0.html

Not sure if you noticed, but there are some link problems. Are you running dual WAN config?

you are right.. apologies for everyone. and about the mentioned setup, i have managed everything by myself, both solution are possible @podilarius thank you, for answer. My question was a little bit tricky, I wanted to know it is posiible to route public network to the same physical segment as LAN. ex server behind firewall has private IP on one interface and public IP on the same interface (ex. virtual interface) with only one physical connection to firewall. And now, I know it is possible, have done this. It is needed to set static routing to public IP behind firewall via private IP.

There are many, many potential problems, from your ISP blocking whatever port you're using to you having the same subnet (192.168.1.) on both pfSense interfaces. Start by checking to see if you can reach the device from the LAN using the LAN IP and the port. Then connect between the pfSense host and the u-verse box and see if you can connect using the WAN IP (and port) of the pfSense host.

How are you getting on? Have you got any further?

Ahh okey, its working now.  :-*