If you don't care what IP your guest network shows to the public, you should be able to do this.

You should simply need to create a source NAT rule for the traffic.

At various locations, I have fiber services delivered without an ISP router from the carriers. Part of that service is also a /29 block of IP addresses.

What I do in those instances is put the /30 public IP that would normally be on the ISP router on my router, then I create source and destination rules to handle the traffic.

ISP Assigned Router IP: 123.123.123.190/30
Routed IP block: 123.122.122.138/29

eth0 = WAN 123.123.123.190/30
eth3 = LAN 10.200.0.1/23
eth3.10 = Public Wifi 10.200.10.1/24

set interfaces ethernet eth0 address 123.123.123.190/30 set interfaces ethernet eth0 description 'AT&T FIber' set interfaces ethernet eth0 duplex full set interfaces ethernet eth0 firewall in name WAN_IN set interfaces ethernet eth0 firewall local name WAN_LOCAL set interfaces ethernet eth0 speed 100 set interfaces ethernet eth3 address 10.200.0.1/23 set interfaces ethernet eth3 description 'LAN' set interfaces ethernet eth3 duplex auto set interfaces ethernet eth3 firewall in name LAN_IN set interfaces ethernet eth3 firewall local name LAN_LOCAL set interfaces ethernet eth3 speed auto set interfaces ethernet eth3 vif 10 address 10.200.10.1/24 set interfaces ethernet eth3 vif 10 description 'Guest Wireless' set interfaces ethernet eth3 vif 10 firewall in name Public_WiFi_IN set interfaces ethernet eth3 vif 10 firewall local name Public_WiFi_LOCAL

Note that I do not assign the routed block to any interface.

Some firewall rules to prevent talking and such..

set firewall group address-group 10_0_0_0_8 address 10.0.0.0/8 set firewall group address-group 10_0_0_0_8 description 'Entire 10.0.0.0/8' set firewall group network-group Public_WiFI_LAN description 'Public WiFi LAN' set firewall group network-group Public_WiFI_LAN network 10.200.10.0/24 set firewall name Public_WiFi_IN default-action accept set firewall name Public_WiFi_IN description 'Public WiFi in to other interfaces' set firewall name Public_WiFi_IN rule 10 action accept set firewall name Public_WiFi_IN rule 10 description 'Allow response to existing connections' set firewall name Public_WiFi_IN rule 10 log disable set firewall name Public_WiFi_IN rule 10 protocol all set firewall name Public_WiFi_IN rule 10 state established enable set firewall name Public_WiFi_IN rule 10 state invalid disable set firewall name Public_WiFi_IN rule 10 state new disable set firewall name Public_WiFi_IN rule 10 state related enable set firewall name Public_WiFi_IN rule 20 action accept set firewall name Public_WiFi_IN rule 20 description 'Allow access to gateway' set firewall name Public_WiFi_IN rule 20 destination group address-group ADDRv4_eth3.10 set firewall name Public_WiFi_IN rule 20 log disable set firewall name Public_WiFi_IN rule 20 protocol all set firewall name Public_WiFi_IN rule 30 action drop set firewall name Public_WiFi_IN rule 30 description 'Block all other access to private networks' set firewall name Public_WiFi_IN rule 30 destination group address-group 10_0_0_0_8 set firewall name Public_WiFi_IN rule 30 log disable set firewall name Public_WiFi_IN rule 30 protocol all set firewall name Public_WiFi_IN rule 40 action drop set firewall name Public_WiFi_IN rule 40 description 'Block all SMTP' set firewall name Public_WiFi_IN rule 40 destination port 25 set firewall name Public_WiFi_IN rule 40 log enable set firewall name Public_WiFi_IN rule 40 protocol tcp set firewall name Public_WiFi_LOCAL default-action drop set firewall name Public_WiFi_LOCAL description 'Public WiFi in to router' set firewall name Public_WiFi_LOCAL rule 10 action accept set firewall name Public_WiFi_LOCAL rule 10 description 'Allow DNS' set firewall name Public_WiFi_LOCAL rule 10 destination port 53 set firewall name Public_WiFi_LOCAL rule 10 log enable set firewall name Public_WiFi_LOCAL rule 10 protocol udp set firewall name Public_WiFi_LOCAL rule 50 action accept set firewall name Public_WiFi_LOCAL rule 50 description 'Allow pings' set firewall name Public_WiFi_LOCAL rule 50 limit burst 1 set firewall name Public_WiFi_LOCAL rule 50 limit rate 62/minute set firewall name Public_WiFi_LOCAL rule 50 log enable set firewall name Public_WiFi_LOCAL rule 50 protocol icmp

Then I use NAT rules to specify how it routes out. I do not have a destination NAT rule here because there is no inbound traffic allowed. the NAT translation should handle the return traffic.

In your case, you could just tell it to use the IP on the WAN interface instead of some other IP.

set service nat rule 5995 description 'Outbound Public WiFi LAN Traffic' set service nat rule 5995 log disable set service nat rule 5995 outbound-interface eth0 set service nat rule 5995 outside-address address 123.122.122.140 set service nat rule 5995 protocol all set service nat rule 5995 source group network-group Public_WiFI_LAN set service nat rule 5995 type source