Maybe I am not getting the entire picture here - or maybe its an IAX
thing - but why do you need to specify port forwarding to every phone?

Lots of our sites have multiple (SIP) phones connected via ADSL to a
central Asterisk server and STUN takes care of 'what goes where' -
there's no specific SIP (in your case IAX) forwarding setup on the
site's router. Remember, the phones initiate the connection/registration
to the Asterisk server and so the setup is outbound with the help of
NAT/STUN- nothing unexpected is initially going to be inbound and thus
needs help getting past the firewall/NAT routing.

Worse case (and I still can't see why you'd need it), why not have a
local Asterisk server to which all the phones register and tie this
server to the remote one?

Fill me in, or tell me to shut up, if I'm missing something here!?