I've seen many posts around the issue of having a second firewall layer (before the LinuxMCE firewall) and having issues with Asterisk. I've read a few docs on the net and I think I might have some up with a possible "solution"... (DISCLAIMER: I have not tried this myself since I don't have LinuxMCE currently set up. It might not work, so try at your own risk) Thanks goes to the voipcoop.org guys for supplying this information:
If you are behind a NAT firewall, you may need to open the following ports to your FreePBX box: For IAX protocol, UDP (NOT TCP) port 4569 (IAX). For SIP protocol, UDP (NOT TCP) port 5060 (SIP) AND ports 10001-20000 (RTP, must also be defined in /etc/asterisk/rtp.conf). All these ports are *UDP*, opening the *TCP* ports will NOT help anything and may expose your system needlessly.
If behind a NAT, create an /etc/asterisk/sip_nat.conf file with AT LEAST these three lines: 1) nat=yes 2) externip=your.external.IPaddess (or externhost=your.external.hostname) 3) localnet=192.168.0.0/24 (assuming your network uses 192.168.0.x addresses). Then "asterisk -rx sip reload" at the CLI.
For firewalls in general, go here: http://www.voip-info.org/wiki-Asterisk+firewall+rules
This would seem to work for SIP, but I don't know about SCCP. Can anyone try this and let us know? Thanks!