Routing part of a /28

[newburns]

I have a subnet from ISP that is xx.xx.72.49 - xx.xx.72.61 useable. (xx.xx.72.49/28)

My ISP Gateway is xx.xx.72.62

I have a pfSense box on xx.xx.72.49 with Gateway set to xx.xx.72.62.
Everything works well NAT'ed through the pfSense firewall, of course. That's the standard setup.

I have a possible client that wants 5 ip addresses.
My initial thought is that I can create vlan100.
Pass the 5 IP address THROUGH pfSense across vlan100 direct to his machines/switches.

I have created the vlan100 in pfSense and on the switch.
What do I do to pass the 5 IP addresses?

I saw something about VIP, but that looks like passing internal network to external Public IP. I want to pass 5 IP from the /28 block direct to his switch on using vlan100. I only have the two NIC for now.

Is this possible?

[Derelict]

The real answer is that the ISP should be giving you a /29 for your interface then routing the /28 to an address on that.

Anything you would do to put a part of that /28 as it is on an inside interface would be an ugly hack. If you want to route a subnet you need a routable subnet.

[newburns]

Understood. Does that mean I can do 1:1 using virtual IP for each static outside of my pfSense boxes? Then add a static route? So internal address will be what I assign, and the virtual IP will be NAT out.

This will allow my clients to run their IP through pfSense until I get the proper setup.

Also, once I get the proper setup from my fiber build out, how will I go about routing to the /28 subnet. The proper one, not this current way.

[Derelict]

You can definitely put an interface on the inside and 1:1 NAT addresses in the /28 to it but the hosts on the inside will have real addresses in RFC1918 private space and pfSense will have to NAT for them.