So I’ve searched the forums and preformed many tests trying to get audio working with remote extensions with my 3CX VoIP phone system. I’ve tested NAT port forwarding behind masquerading, 1:1 NAT before masquerading, disabling SIP firewall helper service, disabling Mangle rules, and every combination of the above I could dream up.

In several of the most promising combination of firewall changes I’ve been able to get all the “Firewall Checker” tests to pass in the PBX management console. However, the phones can register and call phones on the LAN or remote but audio only passes to phones in the LAN. You can click hold and get hold music on the LAN side but not vice versa and of course you can't anything end to end ether direction if one phone is remote in a two party call. Anything not NATed works great end to end. It works in local LAN, routed, L2L VPNs, and remote PCs running PPTP VPN with the 3CX phone client installed.

Its driving me crazy that I can’t get it to work through the firewall because I want to use it on 4G without running some VPN client on the phone. I’m running RouterOS 6.3 currently. Does anyone have this phone system and have this feature working with Mikrotik 6.X firmware, if so please post the config you used to get it working.

I have sometimes seen people NAT the RTP ports but forget to also allow that traffic in the forward chain which produces a similar effect.

I found PBXnSIP (today known as Snom ONE) easier in this regard. With 3CX I had to use a STUN server. This was a while back, however. If you have a setting in 3CX to keep an open UDP session with your VoIP provider, try that.

Basically what is happening is that your RTP packets is coming back in on a different connection and the firewall is rightfully stopping them. So, it is up to you to fix that.