I never got SIP/RTP over NAT work very well either on my setup. I often had one way audio. (Zoiper and IAX worked fine though)
Then I put my remote phones on VPN. I use Yealink T23G and run an openVPN server on my LAN.
Just a suggestion.
This works very well for us and is also recommendable from a security point of view.
This also solved issues with dynamic IP addresses changing on the remote client side. We had port 5060 only open to known IP addresses, otherwise you get hammered with hacking attempts.
Below is a thread you can check out on same issue.