DMZ with Public IP

[bastineerer]

Hi,

can anyone help me to achieve the following:

For a few application servers for none changable reasons I need to build a DMZ were I can configure public IPs on the NICs.
Therefore I can't apply a DMZ with NAT in that case as standard with pfsense.

My WAN provider is routing a /27 set of public IPs that are configured as IP aliases within my pfsense as refer to the WAN interface. As said I need to use some of these IPs to be configured on some machines and still need to control the accessable ports via pfsense instead for putting the machines in front of my pfsense.

I hope I was able to express what I need help with,

best