Normally you don't - as a SIP provider will communicate with your 3CX via TCP and UDP ... The SIP set-up is TCP type protocols - but the conversation is real time UDP. Normally, I just make sure that the router is configured to allow TCP and UDP traffic through on the ports that 3CX needs open ... e.g. this how-to covers the port requirements for any router type ...
http://www.3cx.com/blog/voip-howto/draytek-firewall-voip/
With the firewall open for the traffic, 3CX should do the rest.
You can confirm your ports are open using the Firewall Check test in the 3CX Management 'Settings' module.
Best regards