Opening Inbound Ports to More Than One Private IP Address

Question

Hi Guys, 
 I was hoping someone could answer a questions regarding port forwarding for me. I understand how to setup a DNAT to a single private IP address from an external IP address but I'm wondering how I would DNAT to a whole subnet? I'm trying to open ports inbound for a Vonage Cloud pbx and they require multiple ports to be open for their IP phones (172.16.99.0/24) 
 I've created a service definition group with the required ports and under Network Protection --> Firewall --> Rule: 
 Source: Data Lan (Network) 
 Service: Vonage Service Definition Group 
 Destination: Any IPv4 
 
 How can I open the ports for inbound to more than one private IP address? 
 
 Thanks for any help!

DouglasFoster · Answer

I am pretty sure that you want a masquerading rule, not a DNAT. The phones will be the source, client connections use a randomly-assigned source port. The destination will be a specific port on a Vonage server. 
 The point of their requirement is that you need to allow outbound connections to their designated port. Many configurations will allow all outbound traffic by default. More cautious configurations will block unneeded ports until a specific reason is given to open them up. The more restrictive configuration strategy makes an infection less able to connect to a bot controller for instructions.