SIP security/Service configuration

Team,

Let me explain the current setup first. I have installed trixbox 2.8.4 and configured Astaro 9.0.4 under DMZ zone. I have created DNAT and allowed SIP service port 5060. I have successfully registered the SIP server (hosted in DMZ) in my softphone (located in external network - WAN) through public IP. I am also able to successfully make calls from Soft phone (External WAN) to the IP phone (located in Local LAN)

Issue:-

I am able to hear the voice from the IP Phone in the softphone, but I am unable to hear the voice from the softphone to IP Phone.

In addition to resolving the above issue, I also need your valuable suggesstions / advise on finalising a best secured method to configure Astaro to allow the multiple users from External network to access my trixbox and communicate with my Internal useres in LAN (IP Phone / Soft phone)
:
a) Is there any additional ports that need to be opened in firewall
b) Do I need to do any more port forward in DNAT.
c) Do i need to keep the VOIP server (trixbox) under DMZ and do DNAT? (When tried this option, facing the same issue)
d) Keep the server in DMZ and configure SIP security under VOIP security tab. (When tried this option, facing the same issue)

Pls suggest and advice me the configuration steps.