I have a user in outer who-knows-where with an xlte phone which times out trying to register. Port 5060 is open both ways, no VPN or anything. Are there other ports I should tell them to open? I thought 5060 was the one.
SIP uses UDP port 5060 for signalling. The media is sent using RTP. Asterisk’s default configuration uses UDP ports 10,000 through 20,000 for RTP.
Did you check the 5060 “is open both ways”? It can be easily dropped by your user’s ISP
are you saying he needs udp 10,000-20000 open?
udp/5060 (according to rfc, it can be tcp/5060 or sctp/5060) is used to control “something” 
This “something” (audio/video?) is going to be send, using RTP. RTP uses even port numbers without limitation (on rfc). BUT rtp.conf limits the interval for Asterisk - from rtpstart to rtpend.
example RTP data tcpdump:
p.s. correct me if I’m wrong
imho it should register