Your post, Ian, is very "raw"! Don't quiet follow some of it. But will make a few comments...
I'm pretty sure that you do not need to setup rules on your core - when the process starts 'listening' at a port, this effectively allows communication on that port.
Firewall rules on the core are active as soon as you create/edit them, no need to reload.
I think you only need 5060 NAT'd
I think you will find the media channels are all TCP not UDP - update that rule on your router - this is probably why you are getting no sound on remote initiated calls. The TCP media channel connection from you to the remote end is successful because it is outbound initiated so requires no rules. But the media channel from the remote end to you (ie the sound) is remote initiated and thus cannot connect because there is no valid TCP rule...
Also, you are mapping 10,000-20,000 to only one internal port - 10,000. This is definitely wrong! You need to map them to the same port, because this is exactly what the core is expecting and listening on. During the SIP negotiation, the remote end tells your core that it will initiate a connection on, say, port 12,345.. that is what the core will listen for. You are then mapping the inbound port 12,345 to internal port 10,000. Miss. You probably have to tell your router port 0 so that it maintains the port mapping. ie you want a NAT not a PAT.
Suggest you update this and the TCP, and try again. Failing that, perhaps try UDP after all