SIP Connections and NAT/FW Configuration

I'm trying to set up and support a Vonage VOIP phone behind a SuSE 10.0 firewall. Outbound calls work fine. Calling in is the problem. As far as I can tell, I need to forward SIP from the outside zone to the internal zone so the Vonage VOIP device (Motorola VT 2142) can set up the call session. The VT 2142 does not have/support an IP address, so I'm not clear on how to route SIP once it transits the FW, or how to broadcast it such that the VT 2142 endpoint establishes the session. I'm also not sure what the securtiy risk is opening up UDP 5060 from the outside -> inside is, so insights there are appreciated. At any rate, I'm just getting into this, so I'm coming up to speed. Any pointers would be appreciated.