Thanks for the replies, guys.
It's running in Serveronly mode because the customer freaked when I explained the server-gateway mode. The MBG in the server has only 1 NIC (it's vMBG if that makes any difference, but the physical server itself has only 1 NIC).
I managed to get into the router setup this afternoon and check out the port forwarding - it was, as expected, a shambles, so I wrapped most of it up in 1 rule: UDP 1024-65535. (Previously they had it split into chunks where they were missing a great deal of ports used for voice comms, why I have no idea).
I also tried to get into the advanced tab for you, bobcheese, and while I was in there, I saw the Network Profiles tab - one profile of which was labelled 'Serveronly mode - DMZ configuration'. The one I had previously selected and applied was 'Serveronly mode - LAN configuration'. I ran and applied the DMZ configuration profile and WHAM! calls came through, can hear both ways.
Thanks for the help, guys, I was planning on going on site (100km away from my office) tomorrow to sniff traffic and check the router 'personally' (only
maybe using a steel bat) but it seems like it's working now. I blame this on bad instructions given by me to the server guys (really need to dummy down my requirements and not assume working knowledge on other people's part) and reading I&M instructions for releases out of date (damn you, Mitel course pre-requisites being tied to version numbers!
).