Pfsense – Routing Between Two Networks with WAN and Multiple NICs

This could be cleared up quite nicely by using a one-to-one (or static) NAT. Your interfaces would be set up the same as they currently are, only difference is you wouldn't bridge the WAN/DMZ interfaces.

The only thing this will not accomplish is allowing you to speak from the LAN address space to your external address space. I assume the issue there is perhaps a DNS request is returning the external address? If that's the case then you could change your BIND config to include two different views - an internal and external - to provide different returns based on the source of the DNS request.

I believe the only other solution - to get everything that you're asking for here - is to have both ISPs assign you another block of addresses that you'd use on your DMZ interface.

As for the hardware failure bit, this should work fine as long as your interfaces are connected in the same L2 area as the fist firewall. It sounds like it's active/passive so this should be fine.

It seems that you are using NAT instead of routing between BOX1 and BOX2. BOX2 needs to know how to reach the network behind BOX1. You can either configure static routes, or you can run a routing protocol between the two routers.

Routers learn routes in three ways:

1. Routers inherently know about directly connected networks
2. Statically through manual configuration
3. Dynamically through a routing protocol

Static route configuration does not scale, but it may not be a problem in such a small network. You should not use NAT inside your network, only on the interfaces to the public Internet. Inside your network, just use routing, but you will somehow need to let BOX1 know about any networks behind BOX2, and vice versa. You can configure static routes on each router to do that, but you will need to shut down the NAT on the point-to-point link.