I have spoken to Samsung about WE-voip out of office and what ports i need to open I though it would just be 9012 but they are saying I need 5060 as well, is this correct?
My problem with this is you don't know what IP address your WE-voip will be coming in on so I guess you have to open the port to all!
I always told my customers to lock down 5060 to the IP address of the SIP provider and Samsung have said this before as well but now to get WE-voip working I need to open the port to everyone?
Have any of you been using it like this and what have you done?

We use it in this way port 5060 and 9012 forwarded to the OfficeServ. We do so also at our customers. There are no problems. You can make a restriction when you allow this only in other WLANs because than you programm the WLAN MAC addresses of the mobile clients into your firewall. But then you can't talk over LTE because then, the MAC address of the wlan from your mobile device will not be used.

You also need port 80 open.
This is the port that it uses for getting the profile from the system.

Sorry nameless, but port 80 we don't use. For what should it be???

Port 80 is required for remote registration of we-voip clients according to the manual we have.

It's used to download the profile from the OS7000 system to the mobile phone.

Port 9012 is used for remote dial

Okay, I understand. We do it in this way, that we made the registration only in the local Network via WLAN.
With port 80 you have to enter the public ip into the we voip adjustments?

No, you still setup we-voip with the local ip of the system.

If setting up we-voip for the first time and your not on the local wifi, then you have to put the public ip address in.
the profile will download, then you change to private ip.

Yes we do it in the way you decribed. But we never make a forward of port 80 to the PBX. I don't know, why the officeserv needs a forwarding of port 80 for the WE Client.

According to our We-voip manual it's so that the client can download the profile remote (ie if a user is out and you make a change to the config, they can get the changes remotely rather then having to wait until they are back in the office)

I am currently struggling with We-VoIP on LTE as well. I am pre testing on our in house 7200 prior to deploying to a client. I have no trouble getting it working on my local lan. Even from home where I have a VPN to the office it works even though my home wifi is crap and my home dsl is worse than crap. When I finally get it to register on LTE I can make a call and answer it, I get no voice in either direction and the quality indicator rapidly heads south and the call fails. My initial questions are

should 5060 be forwarded to the MP20 or the OAS address?
Do we need TCP/UDP or both for 5060?

Tech support suggested the LTE network may be at fault. Considering it works at home on a DSL that gets 5M down and .1M up I doubt it.

Any suggestions would be appreciated.

5060 should be forwarded to MP20, since rtp ports should be forwarded to OAS.

There is a setting in We- VoIP regarding TCP or UDP protocol, I use UDP.

I had a case where network was blocking 5060 port, so I used another port translated to 5060 on router.

Thanks for that,

I think I almost have it now. I had to turn off MPS to get it going. Not sure why.

We-VoIP is a SIP extension.

If it's talking to another IP device then MPS/RTG will come into play, just like IP phones to SIP trunks.

Sounds like you don't have the MPS/RTG ports forwarded correctly at the system end.