can't receive calls/can't dial extensions

[ZenMasta]

I am having a problem where I am not able to receive inbound calls. 3cx sees the call, you can see the trunk status showing IN and the caller ID but it will not ring an individual extension or a ring group.

Here is my current config

3cx server is in the cloud - no nat, just windows firewall.
Multiple ip addresses (static) for other websites and services

1 extension is 3cx softphone connected through tunnel
2 cisco spa504g remote extensions

All phones register, I can make outbound calls an all 3 extensions (individually and simultaneously) no problem that I have noticed.

1) dial softphone extension from hardphone - Success
2) dial hardphone extension from softphone - fail
3) dial hardphone extension from hardphone - fail
4) dial in from external pots line - fail

I tried to dial in from an outside pots line and checked the 3cx log. You'll notice my server has multiple static IP's but even if I remove all but 1 IP I still have this problem.

10:04:01.380  Currently active calls [none]
10:03:53.944  [CM503003]: Call(2): Call to sip:111@server_primary_ip.126:5060 has failed; Cause: 408 Request Timeout; internal
10:03:46.691  [CM503008]: Call(2): Call is terminated
10:03:29.380  Currently active calls - 1: [2]
10:03:21.896  [CM503025]: Call(2): Calling Ext:Ext.111@[Dev:sip:111@remote_extension_ip.241.22:12184;transport=UDP;rinstance=55252ef4a6b17ef0]
10:03:21.895  [MS210002] C:2.2:Offer provided. Connection(transcoding mode): server_primary_ip.126:9006(9007)
10:03:21.857  [MS210000] C:2.1:Offer received. RTP connection: 208.94.159.10:20220(20221)
10:03:21.856  [CM503004]: Call(2): Route 1: Ext:Ext.111@[Dev:sip:111@remote_extension_ip.241.22:12184;transport=UDP;rinstance=55252ef4a6b17ef0]
10:03:21.853  [CM503010]: Making route(s) to <sip:111@server_ALT_ip.84:5060>
10:03:21.852  Remote SDP is set for legC:2.1
10:03:21.852  [CM505003]: Provider:[NexVortex] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [] PBX contact: [sip:dW8808jwzN@server_primary_ip.126:5060]
10:03:21.850  [CM503001]: Call(2): Incoming call from 1externalPOTSline_i_called_from@(Ln.10012@NexVortex) to <sip:111@server_ALT_ip.84:5060>
10:03:21.844  [CM503012]: Inbound out-of-office hours rule (unnamed) for 10012 forwards to DN:111
10:03:21.842  Looking for inbound target: called=1DID5433; caller=1externalPOTSline_i_called_from
10:03:21.841  [CM500002]: Info on incoming INVITE:
  INVITE sip:biblesatcost@server_primary_ip.126;transport=udp SIP/2.0
  Via: SIP/2.0/UDP 66.23.129.253:5060;branch=z9hG4bKfd23.d70e64f6.0
  Via: SIP/2.0/UDP 208.94.159.10:5060;branch=z9hG4bK-847ea-4fa80057-bafcf200-527e5ce9
  Max-Forwards: 16
  Record-Route: <sip:[email protected]:5060;nat=yes;ftag=b9f5ed0-13c4-4fa80057-bafcf200-49fd3170;lr=on>
  Contact: <sip:[email protected]:5060;maddr=208.94.159.10;transport=udp>
  To: <sip:[email protected]:5060>
  From: <sip:[email protected]:5060>;tag=b9f5ed0-13c4-4fa80057-bafcf200-49fd3170
  Call-ID: CXC-34-7a072738-b9f5ed0-13c4-4fa80057-bafcf200-3cd6b122@208.94.159.10
  CSeq: 1 INVITE
  P-Asserted-Identity: <sip:[email protected]:5060>
  Content-Length: 0
  
10:03:05.530  [CM504004]: Registration succeeded for: 10012@NexVortex
10:03:05.328  [CM504003]: Sent registration request for 10012@NexVortex
10:03:01.502  [CM504004]: Registration succeeded for: 10012@NexVortex
10:03:01.242  [CM504003]: Sent registration request for 10012@NexVortex

10:55:59.483  IP(s) removed:[ALT_IP_51.84,anotherALT_IP_166.200]

Now, if route my DID back to the server on my LAN, I can receive a call, but then I'm back to the problem with 1 way audio.

So I thought by having a server in the cloud, static ip, no nat, I would be golden, but not so far

Aside from shooting myself in the face, how can I solve my problems?