How to 1:1 Nat

[altoyda]

For the past few months, I been trying to learn how to do 1:1 Nat. Like it's say to do Here https://plexguide.com/wiki/proxmox-pfsense-hetzner/. I have readed each day to learn it. I have been going in circles with it and not able to do it.
By the plexguide link it says to enter your WAN IP address and add a new gateway with the gateway from the Hetzner IP which you can find in Robot. After this, reboot PFSense, and you're able to create VM's.
Do I need to use additonal IP or main IP?
1. How to do it.
2. Do I need to do something to the VM in proxmox after I install the VM
3. Do I need to add a ethnet to the VM or make a vmbr for proxmox with the subnet IP's then at it to VM
4. Can someone be willing to help me with this.

Here are some other guides I have been reading and they have help me to get to where I'm at now
https://dominicpratt.de/hetzner-proxmox-network-configuration/
https://dominicpratt.de/hetzner-and-proxmox-pfsense-as-gateway/
https://dominicpratt.de/hetzner-and-proxmox-using-ipv6-with-router-vm/

Here is my interfaces file

### Hetzner Online GmbH installimage

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback
iface lo inet6 loopback


# device: eno1
iface eno1 inet static
address 95.aaa.aa.14
gateway: 95.aaa.aa.1
netmask: 255.255.255.224
broadcast: 95.aaa.aa.63
up route add -net 95.aaa.aa.0 netmask 255.255.255.224 gw 95.aaa.aa.1 eno1

iface eno1 inet6 static
address 2a01:zzz:zz:zzz::2
netmask 128
gateway fe80::1

auto vmbr0
iface vmbr0 inet static
# WAN Interface
address 95.aaa.aa.14
netmask 255.255.255.255
pointopoint 95.aaa.aa.1
gateway 95.aaa.aa.1
broadcast 95.aaa.aa.63
bridge_ports eno1
bridge_stp off
bridge_fd 0
# Route an eventually ipv4 subnet (!NOTE: in hetzner an ipv4 /29 subnet when routed is completely usable)
up route add 95.xxx.xxx.184/32 dev vmbr0
up route add 95.xxx.xxx.185/32 dev vmbr0
up route add 95.xxx.xxx.186/32 dev vmbr0
up route add 95.xxx.xxx.187/32 dev vmbr0
up route add 95.xxx.xxx.188/32 dev vmbr0
up route add 95.xxx.xxx.189/32 dev vmbr0
up route add 95.xxx.xxx.190/32 dev vmbr0
up route add 95.xxx.xxx.191/32 dev vmbr0

# Says the host where the answer for subnet behind pfsense should be routed
#up ip route add 172.xxx.yyy.zzz/24 via 195.xxx.yyy.zz0 dev vmbr0 #(the ip of via have to be the pfsense ipv4 WAN ip)
up ip route add 192.168.0.0/16 via 95.bbb.bb.218 dev vmbr0
up ip route add 172.16.0.0/12 via 95.bbb.bb.218 dev vmbr0
up ip route add 10.0.0.0/8 via 95.217.bb.bb dev vmbr0


iface vmbr0 inet6 static
address 2a01:4f9:4a:1bb0::2
netmask 64
# Metric 1 because kernel set up a ipv6 route send the /64 subnet over no next hop
up ip -6 route add 2a01:zzz:zz:zzzz::/64 via 2a01:zzz:zz:zzzz::3 dev vmbr0 metric 1

auto vmbr1
iface vmbr1 inet manual
# LAN INTERFACE
bridge_ports none
bridge_stp off
bridge_fd 0


Here is all the IP's from Hetzner.
95.217.76.14 <------------Main IP <------proxmox
Gateway: 95.aaa.aa.1
Netmask: 255.255.255.192
Broadcast: 95.aaa.aa.63

95.bbb.bb.218 <--------additonal IP <---pfsense Im using opnsense
Gateway: 95.bbb.bb.217
Netmask: 255.255.255.248
Broadcast: 95.bbb.bb.223
Separate MAC: 00:00:00:00:00:7F

2a01:zzzz:zz:zzzz:: / 64 <--Main ipv6
Gateway: fe80::1
Netmask: ffff:ffff:ffff:ffff::

Subnet IP:
95.xxx.xxx.184
95.xxx.xxx.185
95.xxx.xxx.186
95.xxx.xxx.187
95.xxx.xxx.188
95.xxx.xxx.189
95.xxx.xxx.190
95.xxx.xxx.191
Gateway: 95.aaa.aa.14
Netmask: 255.255.255.248
Broadcast: 95.xxx.xxx.191

pic is what i would like