Actually I have stated again and again, just don’t listen on 5060 or anything close for your sip connections server or phones . if your provider is not compliant with that then write a rewrite rule on your router for that recalcitrant entity to your new less visible sip bound port.