If you have a WAN subnet of, for example, 3.3.3.3/29 then you have a range of WAN IPs from, say, 3.3.3.2 - 3.3.3.6 (let's assume 3.3.3.1 is your default gateway/ISP router).
If your SonicWALL X1 interface is configured to use 3.3.3.3 then you can use the other available IPs to provide NAT to internal IPs (on your X0 interface, or another interface) OR you can provide Transparent IPs to another interface where devices on that Transparent interface will have PUBLIC IPs (like 3.3.3.4).
The SonicWALL KB you linked to is part of the first case: providing external access using (say 3.3.3.3) to some internal IP (say 10.100.0.3) on a LAN (or DMZ) interface. This is OK for services that are NAT friendly, like HTTP. BUt less so for VoIP protocols that are not.
What you want to do is configure an interface in Transparent mode (which is called Splice L3 Subnet in newer SonicOS releases). Have a look at this KB: https://support.software.dell.com/kb/sw5979
Transparent mode is like the device having a Public IP and "sharing" the WAN subnet BUT is still fully protected by the firewall and security services (IPS/Gateway AV, etc) with no NAT to get in the way.
What to do:
If you have a server on 3.3.3.4/29 which means it has a Public WAN IP and you want to put it behind the Firewall then you want to configure an interface (say X2) in Transparent / L3 Splice mode and connect it there.
- Configure your interface (X2) to be in the DMZ zone (or create a new Zone if you are using DMZ on another subnet)
- Set the IP Assignment to Transparent / Splice L3 mode
- For the Transparent Range select (or create) an Address Object that contains the IP (3.3.3.4 /29 or whatever your subnet is). You can have a single IP in the range, a range of IPs, or a group of IPs. But they must all be from the WAN (probably X1) subnet.
- Give it a useful comment, enable Ping so you can ping the WAN IP, and HTTPS if you desire.
Now you can connect your Linux server to that port (X2, or to a switch connected to that port -- you could have several machines in your range, so long as they all have unique IPs within the WAN subnet, like 3.3.3.5 and 3.3.3.6 in our example).
The Default Gateway of the devices in the Transparent Range (X2 in our example) can be EITHER the WAN IP of the SonicWALL (3.3.3.3) OR the Default Gateway of the subnet (what the SonicWALL has as its Default Gateway, 3.3.3.1 in our example).
DNS should be the ISP's DNS servers or some public ones, like Google's.
You will now need to some Firewall rules:
- Outbound rules (DMZ > WAN) will probably already allow Any/Any/Any which is probably what you want -- unless you want to block some outbound access.
- If you want to be able to Ping or HTTPS manage your SonicWALL from this Transparent IP you will need to allow the correct rules here.
Inbound rules (WAN > DMZ) will need to be created. You will need to create any rules to allow the outside world to access your server, so you might want to create a rule allowing SIP from ANY to your Server (3.3.3.4). Or SSH from "Your External Management IP" to your Server.
You will also want some internal rules as well, you probably have full access from LAN > DMZ to allow connecting from your LAN to your Server.
- But you will likely need some DMZ > LAN rules to allow your Server to connect to your LAN. Such as allowing SMTP from Your Server to your internal mail server (which is maybe 10.100.0.66 on the LAN/X0 interface).
In my experience it can take a few minutes for the Transparent interface to "work" -- so once you configure it and add the rules, try connecting out from the Server to the internet and give the SonicWALL a few mins to update the ARP tables to allow it to work. If it doesn't try changing the gateway on the Server to the SonicWALL's IP. Or test the scenario with a laptop to get a working setup before connecting in your Server.
[Note: L2 Bridge mode is different, that's also Transparent but placing the SonicWALL "inline" more like a switch not a router, if you see that option]
