I have been looking for a solid answer for this for 2 days now and have come up empty handed. We had a single ISP and all of my masquerading rules were working fine. I purposely put the IT VLAN out on a different external IP address compared to normal…