Filter access to ip from WAN with mac address check

[Summer]

I need an advice, we got an Asterisk SIP PBX that run behind the LAN interface, would it be possible to NAT it to the WAN (got a static public ip) (and until here it's all right), and filter the connection from the WAN to this IP adding a check on the mac address of the device that try to connect?