A new PBX is being installed at one of our clients today, and they have requested that we give them one of our unused public IP addresses(Comcast is the ISP, have a block of IPs) for use with the PBX. Additionally, phones on the local network (on the LAN subnet) are going to need a private IP address for the PBX to connect to it. Finally, they want the PBX to be in a DMZ, and not to be behind the firewall.

To clarify, I need to configure the sonicwall to:

  1. Give a public IP address (from Comcast modem) to a device on the network.
  2. Assign a private IP to that device as well, accessible from LAN.
  3. Said public IP address must be a DMZ (no firewall).

What is the best way to accomplish this?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Apr 1, 2018 at 22:41

1 Answer 1


In this situation, you should put your PBX device in DMZ zone, assign a private IP address for it, then create an Inbound access rule and an Inbound One-to-One NAT policy for public/Internet traffic hitting your public IP address gets translated/forwarded to PBX device.

enter image description here

Specifically, you can do following things:

  • Place you PBX in DMZ zone/interface of the SonicWall appliance. You will need to configure this DMZ zone/interface in advance. DMZ interface and hosts/servers reside in this DMZ zone should use a different IP subnet/range than your LAN Zone/network. For instance, your LAN uses the, then you should use for DMZ interface.

  • Assign an IP address for PBX device in subnet. For instance, for the device while is for DMZ Interface (this is also the default gateway for PBX device).

  • At this point, you can create rules and policies on SonicWall for hosts/phones in LAN zone to reach this PBX device in DMZ zone.

  • For public network to reach this PBX device on a WAN public IP address (different than your SonicWall WAN interface), you need to create a Access Rule and a One-to-One NAT policy for Inbound Traffic. Let us assume that you have a public IP range of, your ISP device uses, your SonicWall WAN Interface uses, and you reserve the IP as public-facing IP address for PBX device. Then your One-to-One NAT policy is for => Another way is that you create a One-to-One NAT policy for Outbound Traffic from PBX device, then mirror this policy (reflexive) for Inbound Traffic. You can find the detailed information for this implementation in "Configuring NAT Policies" section in SonicOS Administration Guide.

enter image description here

I hope it is helpful and you can make it!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.