See here that explains it clearly: »
voipdito.com/en/blog/SIP ··· raversalSince the ATA initiate traffic from behind the firewall via registration, there is no need to open up any ports. All subsequent traffic from the server inclusing an invite for incoming call are replies to that.
Your suggestions make no sense. If you disable the SPI firewall and or port forwarding such a large range of ports, you are asking for trouble.
All you need to do it let the ATA knows that it is behind a NAT by turning on the NAT support. It would figure out its WAN address with message from the server.
