I went about setting up a tunnel for my hardphones using the instructions found here: https://www.3cx.com/docs/3cx-tunnel-session-border-controller/ - new link My system is set up thusly: Local IP 3cx: 192.168.0.12 Public IP 3cx: 64.50.120.x Local IP Hardphone: 192.168.1.104 Local IP Proxy Computer: 192.168.1.102 Port 5090/TCP forwarded from 64.50.120.x to 192.168.0.12 First went about setting up the proxy. To that end, I put the following numbers in the following places: IP or FQDN: 192.168.0.12 Authentication: 3cx Phone System, 407/407 On Tunnel: Check box "Use Tunnel to Connect." Use tunnel of host: 192.168.1.102 Remote End of Tunnel: 64.50.120.x Tunnel password: xxx Click close, then login to new profile. I get a display (I'm using desktop mode) of current line status of everybody (like the old Call Assistant used to do). So far, so good, I think. Extension 407 shows up as unregistered, however. I think that perhaps that's the hardphone's trouble, not mine. So I go about setting up my hardphone. I'm using a Linksys SPA-922. My other deployed phone is GS Budgetone 200, but I like the SPA phones better. Here's the settings for that: Proxy: 192.168.0.12 Outbound Proxy: 192.168.1.102:5080 (also tried it with no port number) Use Outbound Proxy: Yes Use Outbound Proxy in Dialog: Yes Display name 407 User ID, Password, and Auth ID are all set to 407. Use Auth ID is set to yes. Phone still doesn't show as registered after a reboot however. I can view status with the 3cx VOIP Client, and it shows the tunnel as being connected. But no registration, and nothing shows up in the logs. Running a netstat at the command line shows my tunnel connection to my PBX, but just listening on port 5080 for a phone to register, which it never does. Any thoughts?