@Derelict:
I would ask the ISP if they can assign a /29 or /30 (OR /31 IN 2.2??) for your WAN interface and route the /26 to you over that. You'd have a lot more flexibility in how you use the addresses that way. (Like putting the /26 (or part of it) on an OPT interface and turning off NAT.)
An alternative might be to bridge WAN with OPT, then assign WAN to use BRIDGE0. Anything you then plugged into OPT would effectively be out on the /26 with your WAN address. But an outside switch can accomplish the same thing. You lose essentially all firewalling capability this way.
^^^ What he said, Option 1.
Generally speaking, ISP's will give you a L2 point-to-point and a L3 routed block, most people install a router with the p2p (/30) on the front, and the routed block (/26) on the back-end. (You would then IP you firewall on the /26) In this case, the router becomes a single point of failure.
Ask for an L2 /29 from the ISP so that you can support redundant pfSense Firewalls, then use your L3 /26 behind it on your DMZ interface. You can still do NAT for certain hosts if you want by using VIPs, but you'll also be able to assign the public IP's directly to hosts by connecting them to the DMZ network.
[One day pfSense may support HA with smaller blocks (/30 or /31), but until then I would recommend a /29]
…ct
