What ports should I forward on my NAT device to make SIP work?

There are two types of traffic that need to be forwarded; SIP signaling and RTP media.

The default port for udp based SIP signaling is port 5060 and while most PBX devices will use port 5060 for signaling you will need to check your PBX to find out what port it is using.

The RTP media traffic (the actual audio stream) uses a range of udp ports that varies greatly from PBX to PBX and is usually configurable. A typical range might be 10000-20000. However, you will only need to utilize a range that is large enough to support the number of simultaneous you plan to have so in the case of port forwarding it makes sense to configure your PBX to use as small a range as makes sense - say 10000-10100 - and forward only those ports.