An update to this ask: I more or less flipped the thing upside-down yesterday. Instead of using IP Passthrough to hand all the DHCP business to the Eeros, I instead put the Eeros in bridge mode, so all the DHCP stuff is being handled by the BGW320. It's behaving pretty well, and I have been able to assign a public static IP address to the NAS. The NAS is now of course being subjected to a range of scanning attacks, but my firewall appears to be holding. I would very much like to install a network-level VPN, though (unsurprisingly) AT&T has their hardware locked down in a way that pushes you toward their VPN-as-a-service. If y'all have suggestions for ways to get around that, I'm all ears! #AskFedi #BGW320 #VPN