Thank you for the response.
If the phones are on the same network as PBX all works fine. So, not an ACL issue. But this is not practical as the PBX is on a public network.
Pretty sure it's a NAT issue, just not sure which specifically.
We have another phone at an offsite location also behind...