asterisk users - Jan 2006 - cannot register whit sip client when i'm outside the PBX LAN

I can use PBX from local LAN. I can also receive SIP calls thru the net.
Instead, i've got problem when trying to register the sip client and i'm
  not onto the PBX LAN.

I get:

NOTICE: chan_sip.c:7708 handle_request: Registration from 
'<sip:gallo-shphone@172.16.1.4>' failed for
'HOME_PUBLIC_IP'

This is the PBX location:

OFFICE LAN <== 192.0.1.0/24 ==> PBX <== 172.16.1.5 ==> Firewall
<==
Internet ==> DSL Router <== Home

Firewall is portforwarding UDP porta 5060, 10000-12000 to the DMZ PBX 
IP. From home i can call sip:100@FW_PUBLIC_IP directly... but he give me 
that error if i try to register it instead

Thi si my sip.conf

[general]
language=it
context=voip-inbound
port=5060
bindaddr=172.16.1.4
tos=lowdelay
canreinvite=no
videosupport=no

; Works
disallow=gsm
allow=alaw
allow=ulaw
dtmfmode=inband

nat=yes
srvlookup=no
externip = FIREWALLIP
localnet=192.168.1.0/255.255.255.0

[agallo]
context=interni
type=friend
username=agallo
secret=agallo
callerid="Antonio Gallo" <201>
regexten=201
host=dynamic
canreinvite=no
qualify=yes
nat=yes