I've just got it working, here's the setup ...

CNET CWR-500 (old 802.11b wireless router) set to forward ports 3478 & 5000-10000.
-> wired connection to a Netgear GS108 Gigabit switch
-> wired connection to a Grandstream Handytone-286
-> (currently) an old analog phone

The key to getting this working was to set the Handytone as follows:
SIP Server: freespeech.ie
SIP User ID: 076xxxxxxxx
Authenticate ID: 076xxxxxxxx
Authenticate Password: <my password>
User ID is phone number: Yes
SIP Registration: Yes
local SIP port: 5060 (the default)
local RTP port: 5004 (the default)
Use random port: No
NAT Traversal: Yes
STUN server is: stun.freespeech.ie:3478
Use NAT IP: <my fixed IP address>