For voice and management on IP PBX systems the ports below must be forwarded to the internal PBX. Another critical point: keep management login pages well-protected with strong passwords. We have been hearing about company PBXs being hacked, resulting in serious phone bills.

Ports to forward:

TCP port 22

UDP port 5060

UDP ports 10000 to 20000

For security, 5060 and 10000-20000 should be restricted to the accessing IPs only.