This config works by port forwarding RTP traffic to the asterisk and ATA on both ends. From what I've seen SIP does not handle RTP traffic well with double NAT when port forwarding of RTP it not used.

I've got the following network topology. The far left is an asterisk box I terminate all my VOIP calls through. The far right is my ATA and desk phone, a sipura spa2000.

This is how I do double nat sip with asterisk.

On the asterisk end far left, sip.conf has this in the general section

For the account I have for my ATA to authenticate I have this

In rtp.conf I lock RTP traffic to ports 10000 through to 10100

On the far left Linux router I port forward the following

Now over to the right side which is my office. On the far right dsl router I port forward the following

The dsl router allows me to add static routes. 192.168.100.0/24 is routed via 10.10.10.2 on the dsl router. Another way I could of done this was to add the 10.10.10.2 to a DMZ (which most dsl routers support) and then port forward 10000-10100/udp to 192.168.100.100 on the linux router.

Within the Sipura config I lock RTP traffic to ports 10000-10100/udp