Correct way to configure an IP range for firewall

[Maxim Khitrov]

Hello all,

A quick question - I have a /29 block of IPs that needs to be handled
by a firewall I'm setting up. Two addresses are lost to broadcast and
network, one is the ISP gateway, so we end up with 5 usable IPs that
can be assigned to the external interface. The question is how to do
this correctly?

I want only one of the addresses assigned to the firewall itself,
another will be used as the public nat address for all hosts on the
lan. Remaining three addresses will be used as bidirectional nat for
servers.

Am I correct in assuming that I just need to add four
ifconfig_vr0_alias[0-3] lines to rc.conf? What happens if in the
future we get a much bigger IP block, is there a more efficient way of
accomplishing the same thing? I don't actually want the firewall to
consider itself the final destination for any of the additional IPs,
it just needs to pass them to pf for nat and filtering.

- Max