asterisk users - Jun 2004 - SIP extension outside of IP tables firewall

I have an Asterisk PBX on the private lan, which is protected
from the public Internet with a Linux iptables machine. The
firwall is it's own seperate box running NAT with SPI.

I want to drop a SIP phone at my brothers house, and have it be an
extension off my Asterisk box.  I've been looking around at some FAQ
info on forwarding ports, and also looked at siproxd. 

Anyway, I'm posting this, because this seems like a really
"standard"
thing people would want to do with Asterisk/Iptables, so is there
a standard solution that I can apply?

Brian Weaver wrote:
> I have an Asterisk PBX on the private lan, which is protected
> from the public Internet with a Linux iptables machine. The
> firwall is it's own seperate box running NAT with SPI.
The only way to make this work well is to run a SIP proxy of some kind 
on the firewall system and tell the SIP client to use that proxy. 
Asterisk providing SIP behind a NAT and/or firewall is very difficult to 
get working. A SIP client behind a NAT, on the other hand, works fine as 
long as the client supports STUN.