This is pretty simple to do. It all depends on how secure you want it.
Search web for:
Asterisk NAT firewall
example in sip.conf. Replace addresses with your settings.
externip=(your public IP)
localnet=(local Net)/(local mask)
Set exceptions in your firewall.