D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 233 / 469

• Source Network: 0.0.0.0/0 (all-nets)
• Destination Network: wan_ip (external IP of the firewall)
• Comment: Allow incoming calls to H.323 phone at ip-phone
3. For SAT enter Translate Destination IP Address: To New IP Address: ip-phone (IP address of phone)
4. Click OK
1. Go to Rules > IP Rules > Add > IPRule
2. Now enter:
• Name: H323In
• Action: Allow
• Service: H323
• Source Interface: any
• Destination Interface: core
• Source Network: 0.0.0.0/0 (all-nets)
• Destination Network: wan_ip (external IP of the firewall)
• Comment: Allow incoming calls to H.323 phone at ip-phone
3. Click OK
To place a call to the phone behind the D-Link Firewall, place a call to the external IP address on
the firewall. If multiple H.323 phones are placed behind the firewall, one SAT rule has to be
configured for each phone. This means that multiple external addresses have to be used. However, it
is preferable to use an H.323 gatekeeper as this only requires one external address.
Example 6.8. H.323 with Gatekeeper
In this scenario, a H.323 gatekeeper is placed in the DMZ of the D-Link Firewall. A rule is configured in the firewall
to allow traffic between the private network where the H.323 phones are connected on the internal network and to
the Gatekeeper on the DMZ. The Gatekeeper on the DMZ is configured with a private address. The following
rules need to be added to the rule listings in both firewalls, make sure there are no rules disallowing or allowing
the same kind of ports/traffic before these rules.
Web Interface
6.2.8. The H.323 ALG Chapter 6. Security Mechanisms
233