so set opnsense in two networks and route all public ip ranges through the egress port of the opnsense. i will check.