If you have followed our Firewall Guide (What firewall changes do I need to make to use this service?) but are getting the above problem, then this may be this issue you are struggling with: (taken from: https://www.onsip.com/blog/disable-sip-alg-and-forward-nat-ports-to-stop-dropped-calls)
Turn Off SIP ALG
An Application Layer Gateway (ALG) is designed to push specified kinds of traffic across your router's NAT and firewall. A SIP ALG is specifically designed to pass SIP traffic through your router's NAT/firewall to reach your phones. The problem with a SIP ALG is that most SIP packets are already optimized to pass through NATs/firewalls without additional help.
Ironically, a SIP ALG can end up interfering with traffic headed for your phone. A SIP ALG can re-write SIP packet headings, which can mangle the delivery process. This can make the device you're calling believe that your phone is not behind a NAT, when in fact it is. If an ALG disrupts a call, it can lead to incoming call failure, and phones that unregister themselves.
The SIP ALG is not fatal in and of itself. There are times when SIP ALGs won't cause problems. However, in many cases, they are the cause of dropped calls. SIP ALGs are usually enabled by default. The process of disabling a SIP ALG varies by manufacturer. Consider your router's documentation for more information. VoIP-Info has a fairly comprehensive guide on disabling SIP ALGs