Hi Rob,
"330 SIP Phone->VPN Endpoint->Internet->VPN counter->3CX Server" this setting works fine and close to perfect for multi remote branches at 3CX version 3. However, at version 5 all remote SIP devices almost totally failed.
Testing result for remote hardware SIP phone LAN to LAN VPN to HQ 3CX BOX:
Polycom IP330: failed
SMON 320: failed
eyeBeam 1.5: failed
SIP T10P: works fine
SN4114 4 x FXO gateway: failed