# Yet another firewall question:

**URL:** <https://community.asterisk.org/t/yet-another-firewall-question/6263>\
**Category:** Asterisk Support\
**Created:** [May 9, 2006, 8:10am UTC](https://community.asterisk.org/t/yet-another-firewall-question/6263 "2006-05-09T08:10:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ThePhoneGuy](https://avatars.discourse-cdn.com/v4/letter/t/ee7513/32.png) [@ThePhoneGuy](https://community.asterisk.org/u/ThePhoneGuy)\
**Post date:** [May 9, 2006, 8:10am UTC](https://community.asterisk.org/t/yet-another-firewall-question/6263/1 "2006-05-09T08:10:20Z")

</div>

My Asterisk has a public IP address and a few remote soft and hard phones (SIP) that register from various other networks. It has been working fine up until recently…

I installed a hardware-based router/firewall in front of the Asterisk and opened the applicable ports. However, now in order to get the remote soft/hard phones to register, they each need to open the firewalls on their remote end by opening all voice related ports and making their IP a DMZ. I would prefer not to do this as it shouldn’t be necessary.

What the heck is going on? It doesn’t make sense to me. I tried adding an “externip” and “localnet” address to the sip\_nat.conf but that didn’t help.

Thanks,

-TFG

---

<div class="post-metadata">

**Author:** ![dmikusa](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@dmikusa](https://community.asterisk.org/u/dmikusa)\
**Post date:** [May 9, 2006, 1:51pm UTC](https://community.asterisk.org/t/yet-another-firewall-question/6263/2 "2006-05-09T13:51:05Z")

</div>

What does you sip.conf configuration look like for the remote phones?  
Have you tried using host=dynamic and nat=yes?  
Also is you Asterisk box being nat’ed or does it still have a public ip?

Dan