@nasheayahu 

Sorry that I am not rude to you. But your map looks like not right at all. 

Not sure the centurylink. Are you running two NATs or triple? 

What I see R600 got its WAN and LAN IP + pfsense got its WAN IP and LAN IP. While the pfsense does not look right at all. If your map is like this, I can only assume "WAN" is mistaken. That is LAN? R600 is on sunbnet 192.168.0.1/24

First off, why would you need triple or double NAT for the whole network? More NATs are adding up unnecessary layers to the network. People want to remove as many nats as possible. 

PS i believe you have triple nats after reviewing your words multiple times and trying to figure out what's best for you. centurylink is a wireless modem router. 

While any devices on centurylink LAN can access R600 by the WAN IP on R600 which means you need to either set a firewall rule on centurylink to allow a single IP(in the centurylink LAN) or you set a remote management on R600(not sure if you got this function on R600, I know omada certainly does it).

The rule should be like 192.168.1.100/32 which 255.255.255.255 indicates a single IP. So the computer or whatsoever using the IP in centurylink LAN(192.168.1.1/24) can access the WAN IP of the R600. 

BTW, if you are not talking about this, but worried about the network security, not too many aspects you should be worried about, because that NAT is some kind of firewall that can help protect the devices in the network.