How to properly configure Firewall and NAT so that Grandsteram UCM6104 IP PBX can work with external SIP trunks?

Question

Asterisk

Hello.
There is automatic telephone exchange Grandstream UCM6104. I configured internal communication, I am confused to configure outgoing external communication.
In the future, the SIP telephony provider will be Beeline, which owns certain city numbers. While I'm trying to test everything on the Zadorma provider.
I create a Zadarama trunk in the PBX VoIP settings and configure the rules for its use for outgoing calls. When trying to dial a landline number from the office, the PBX shows in the status that the Zadarma trunk is in use, but the number is not actually connected. After a while (about 30-60 seconds) in the handset it is pronounced in a voice - All lines are busy. Perhaps the voice announces the ATS Grandstream. In the trunk settings, I check the "NAT" box - it does not help.
I suspect that this may be due to the Firewalla and NAT settings.
On the way out, all ports on our router are closed by default, but I allowed any outgoing connections from the internal IP address of the PBX. Those. the PBX itself can go online by connecting to any address and any port, and back, perhaps something is cut by the firewall. Tell me which ports to open for input and output. And what ports need to be forwarded to the IP address of the PBX.
Here is what Zadarma support replied:

Ports used (Must be open in the firewall for entry and exit)
For signaling traffic:
UDP 5060 Or TCP 5065
RTP ports for media traffic (Voice)
UDP 10000-20000

Answered in the evening, I will try in the morning.
I understood about the ports that need to be opened in the firewall.
And which of these ports need to be "forwarded" to NAT? (For the router to forward requests to the external IP address to the internal IP address of the PBX). I suspect that only some of these ports need to be forwarded? A range of 10,000 ports to open for input and output, and forward all of them - in my opinion, it may be redundant.
Do all ISPs need to open and forward the same ports? Or do different providers have different ranges?

Answer 1

For those who will look for a solution in a similar situation.
Only one port, UPD 5060, needs to be forwarded to NAT.
In some cases, providers use TCP 5065 as an alternative.
The remaining ports (10000-20000) do not need to be forwarded. It is enough to open them in the firewall for entry and exit.

Answer 2

chain=dstnat action=dst-nat to-addresses=YOUR_ATC_IP protocol=udp dst-address=YOUR_WAN_IP in-interface=wan1 dst-port=5060,10000-20000