In my sip.conf the entire NAT section is commented out. I do have “nat=yes” on the two devices that I use that might connect from outside (a softphone on my laptop and the 3cx SIP softphone on my Android smartphone).
The “modprobe nf_nat_sip” line is the first line of the “pre-boot” script managed through the ZS GUI.
By the way, forgot to mention in the first response that the nf_nat_sip module also deals with the RTP stream, so you don’t need to map those ports to your Asterisk box.