It could be a CG-NAT issue. Vodafone use it in abundance. I have managed to get several VOIP accounts to register through a session border controller (Ingate SIParator 21) setup in DMZ mode with ports 5060 and whatever port range you use for RTP forwarded to the SBC. However, I don't think DMZ and Port Forwarding work with CG-NAT as we still get one-way audio on incoming calls from time to time. Using a DDNS service (No-IP.com) has helped the SIParator to navigate the CG-NAT and the external provider's SIP server always shows the correct, and ever changing, public IP address as the source. I tried using DrayDDNS and DynDns but they picked up the intermediate CG-NAT IP address not the actual public IP address. No-IP was the only service that passed on the correct IP address. You can also try using a VPN configured on a gateway on a stand-alone device running something like pfSense, using OpenVPN or L2TP/IPSec and create a tunnel that has a static IP address and then route just the SIP traffic down the VPN. We have tried both these ways and neither is 100% effective. The only thing that works perfectly is the solution used by 3CX for connections from customers to their cloud PBX, which we also use. If you have IP phones with built-in routers (like the Yealink T-5x range) set up one as a SBC with a tunnel to the SIP server and a static IP address and use the private IP address of the router phone as an outgoing proxy server address on the other phones. But this only works because it is a P2P connection down the tunnel direct to the 3CX server at the other end and it keeps the connection open, which Vodafone may not allow even if you set up a P2P connection to the Vodafone server (if Vodafone is your VOIP/SIP provider as well as your ISP). Or change ISP to a provider like Andrews & Arnold and get a connection with no NAT and a block of static IPv4 addresses or use IPv6 where NAT is not a factor. The free Hurricane Electric IPv6 Tunnel Broker service (which runs over an IPv4 connection) is also an possibility but you can't ping your public IP address with CG-NAT so setting-up the tunnel fails at the first step. There are solutions that can get you success 80% of the time but only the 3CX one works with 100% of incoming calls.
