pfSense

When a SIP peer starts the dialog, it sends thru SDP the port on which it is expecting the RTP stream.
There are of course various ways to survive without static ports, but they make it easier.

We use a sip server which handles both trunking and remote users. We typically use static port NAT for both functions. While we know what IP address internally would be requiring static port NAT, we also know what ports it will be using, because we can define them. Static port NAT is not unusual to see when the sip server is behind NAT and handles trunking and remote users unless it is using a robust SBC which also manipulates the headers and uses STUN support to get around a firewall which rewrites the source port.

When a firewall rewrites the source port it usually means the audio is going to be broken, hence the firewall using static port NAT to ensure the firewall is more or less "uninvolved" and the sip server or client sees the media return to the expected port(s).

Mistake in the patch files.
In firewall_nat_out_edit.php, you should add after lin 223:
$natent['sourceportend'] = ($protocol_uses_ports) ? $_POST['sourceportend'] : "";

This is rendered useless by support of port alias. No need to implement this anymore.

I can't find how to close the task myself, so if someone could tell me how to (if I can!) or could close it...