As long as you have related/established enabled on your firewall, your system should reach out to the media destination during the process of setting up the call and thereby open the port for responsive packets from that same destination.
My FreePBX is behind a router that is configured to act like any router. I have IPTables configured to block all traffic unless it is on my LAN, or it is related to a packet my system has sent out. I have not opened any ports on my router. I use Flowroute. I have no problems at all with audio on my calls.
In the old days, you could have audio problems because your CHAN_SIP settings were misconfigured. You could overcome that problem by forwarding ports, but that is like leaving your doors unlocked because you think it’s too hard to use a key. It will work, but at the expense of security.