My ISP allows me (for a fee) to get an additional routed subnet in addition to the single IPv4 address that comes with the ISP connection. I have been putting test equipment, ATLAS probes and the like on the subnet and that "just works" on a C7 on OpenWRT 18.
I had created another firewall zone next to WAN and LAN, put the subnet in there and it all just worked.
Since that version has been obsoleted for years, and because of the plea of the OpenWRT dev team to use devices with enough CPU, RAM and flash, I'm replacing the C7 with an ER-X box running 23.05.0. And it all seems to work, except that IPv4 outgoing connections from the subnet now use the main IP address of the connection, i.e. they are NATted instead of simply routed which is what the C7 used to do.
I can't figure out how to disable outgoing NAT if the connection comes from my subnet IP address. In Network -> Firewall, in the Zones area, I have ONE line for the WAN zone originating and ONE masquerading checkbox. I have not found a way to disable masquerading for packets coming from the subnet zone, going out the ISP connection.
Suggestions please?