It is 5020 phone emulation, so check out 3300 tech handbook. There is a list of used ports in there.
If you are doing port/address translation, please let me know how it is going. Signaling channel is connected to the controller, but media (voice) will try to stream directly. So that means address information transmitted in signaling messages will be incorrect. This is why you need o have TW server behind NAT. I'm afraid you will have "no-audio" or one-way audio issues.