Gentlemen,
You must should take into account that voip requires two connections: sip (registration) and rtp (sound). And take into account there is srtp (encoded rtp), too. srtp may need to exchange certificates from phone and voip board both ways.
You should prefer srtp to prevent listening to phone-calls using wireshark or something else.
I.
Sip often uses udp and port 5060-5063. You'll have to check this in the docs of your voip-board. It could be tcp-protocol and different ports.
Then try to put your voip-Board out of your green net and behave as if its ip-address was "firewall blue" using firewall rules:
source: (ip of voip-board)
Source-NAT: new source-ip-address: firewall blue.
protocol: udp(?), target port 5060-5063(?).
You may not need port 5060-5063 but one or two of these ports. Maybe your board needs one individual port to reach each individual phone. The port may be reserved for some time, like a lease time in dhcp.
And you have to allow the other way round
source (blue ip of phone)
destination nat firewall blue
host: blue ip of phone
protocol: udp(?), target port 5060-5063(?).
Some voip boards use different ports / protocols for traffic concerning phones and concerning phone provider. On some voip boards you are allowed to change these params.
In fact you take your phone out of your blue net and behave as firewall blue using firewall rules.
Let the devices match on firewall's blues ip-address.
II.
rtp often uses ports in the range of udp 49100-50500. So you have to set up firewall rules
as before.
III.
If you like, you can put your phone out of blue into green instead:
source: phone’s blue ip
destination net firewall green
target host fire voip board
protocoll udp, port 5080 (example internal phones)
And the other way round:
voip board’s ip destination nat firewall green
protocoll udp source port 5080.
… and same to match voip board and phone on firewall green’s ip to exchange sound in rpt protocol.
IV.
Don’t forget DNS. Maybe it’s enough to setup rules like:
source: standard network green
destination net: firewall-interface automatic
target: firewall all
ports 853 and 53 tcp and udp.
Don’t forget loopback source 127.0.0.1, target firewall green and firewall blue
And the other way:
source standard network green
destination net firewall automatic.
target firewall all.
ports 853 and 53 tcp and udp.
VI.
Maybe there is one of the network-admins in the forum to simplify may examples or give so hints about security improvement.
VII.
I never used pbx, but I wonder if pbx may need other requirements (except ports and protocol) as sip/rtp.
I never tested dhcp.
Its easy to end up with 90 firewall rules if you do the same for phone, printing from wlan-clients on blue to printers on green, wlan-clients on blue to network-storage on green.
Good luck.
