It isn't just SIP. You will need to set up NAT traversal and make sure RTP traffic can pass as well. Setting up a STUN server and configuring the clients to use it should aid in the NAT portion. The RTP traffic should be fine as long as pf is being stateful. If the phones register over SIP fine, but have no audio, then the RTP traffic isn't getting where it should. IMO, it makes more sense to use an on-site PBX so you only have to deal with traffic to/from the one host, but that doesn't sound like an option for you.
-- Byron Grobe
