How to make a two-way trunk in FreeSwitch through a non-own NAT?

Question

FreeSWITCH

There are 2 FreeSwitches, one on the Internet at a white address, the other behind a NAT organization (and even without a white address, then another NAT provider), which just let you use the Internet. An authorization extension was created on the external server. From within the network, a trunk was created to an external server under this user.
Calls from the inside go out through the trunk. The main question is how to call back, inside the network through this single connection.

The problem is that FreeSwitch, by default, cannot do a full-fledged inbound Trunk with separate authorization like asterisk by account and without specifying a static address, in all examples they either reconfigure NAT or make an IP filter, incoming authorization is tied to either IP or extension. And yes, there is fusionPBX, there is direct access to xml only in the dialplan.
The inside of the trunk is made like this:

<gateway name="MyTrunk-to-external">
    <param name="username" value="1002"/>
    <param name="password" value="****password"/>
    <param name="realm" value="domain.domain"/>
    <param name="proxy" value="domain.domain"/>
    <param name="register-proxy" value="domain.domain"/>
    <param name="expire-seconds" value="60"/>
    <param name="register" value="true"/>    
  </gateway>

On external automatic telephone exchange - simply extension.
If I manually make a route like this on an external PBX when calling an internal PBX to number 7000:

<condition field="destination_number" expression="^(70\d{2})$">
....всякие стандартные set......
<action application="set" data="callee_id_number=$1"/>
<action application="bridge" data="user/[email protected]${domain_name}"/>
</condition>

where 1002 is the user under which the trunk connects from the inside, then calls inside to the PBX go through, but the INVITE line cannot be controlled, this comes, there are no numbers:

INVITE sip:[email protected]:5080;transport=tcp;gw=228322f9-66-48e4-b481-098a4bf2e185 SIP/2.0

I found that you can shove different parameters into a string, for example NPDI for such cases:

<action application="export" data="sip_invite_tel_params=rn=$1;npdi=yes"/>

then INVITE comes with at least some information about the initial set number (the rn= field):

INVITE sip:gw+228322f9-ea66-48e4-b481-098a4bf2e185;rn=7000;[email protected]:5080;transport=tcp;gw=228322f9-66-48e4-b481-098a4bf2e185 SIP/2.0

So you can make a crutch and call the internal PBX using the received RN number manually, since freeswitch does not process npdi by default:

<condition field="destination_number" expression="rn=(\d{4}\@?.*)">
     <action application="transfer" data="user/[email protected]${domain_name}"/>
</condition>

If you set the parameter on the internal PBX on the trunk <param name="extension-in-contact value="true"/>, then the registration user name will be in the INVITE field ( INVITE sip:1002;rn=7000....), if you add <param name="extension" value="7000"/>it, the call will simply always come to this number, regardless of the dialed number ... I
tried to create a trunk on the external PBX with a binding to the user's extension, to which the internal PBX is authorized

<gateway name="MyTrunk-to-external">
    <param name="username" value="1002"/>
    <param name="password" value="****password"/>
    <param name="extension" value="1002"/>
    <param name="realm" value="local.domain"/>
    <param name="proxy" value="local.domain"/>
    <param name="register-proxy" value="local.domain"/>
    <param name="expire-seconds" value="60"/>
    <param name="register" value="false"/>    
  </gateway>

but as expected, Bridge did not work there, falls off by timeout. If the proxy is removed or set to 0.0.0.0, then the same thing.
1 How to do it more correctly, so that a non-programmer can then connect such trunks and configure routing in simple ways, as with ordinary trunks and not through picking crutches?
2 Whether it is possible to create such gateway on an input on external automatic telephone exchange that to connect to it simply on dialplan routing?