All right, so it appears it works if both line = yes and from_user are set on the NAT server. I guess from_user is necessary when registering to an Asterisk server that uses PJSIP, but not if registering to an Asterisk server that uses SIP.
As far as auth_username goes, this is what I had been using on the public side hitherto:
type = global
user_agent = Asterisk
endpoint_identifier_order = username,ip,anonymous
My usernames and auth IDs for endpoints are always the same, so wouldn’t this capture essentially the same thing? Your comments here make it sound like you need one or the other: PJSIP trunk to another Asterisk 13 server unable to authenticate unless I set from_user = username - #20 by jcolp
I always want to match on username for any endpoint, not IP, because otherwise multiple registrations/endpoints from the same IP address can get mixed up.