OK, so I got this working, but I'm unsure as to why. On a hunch, I changed the sip-ip and rtp-ip on the Fusion internal profile to track the external IP address. This got the phones outside the firewall working, but broke the ones inside the firewall (SIP was OK, RTP was not).
I then changed...