Now my best guess (as of yesterday) is that the firewall on my wireless router is blocking incoming calls\data. But I no longer believe that since I turned the firewall off as a test, and it still didn't work.
I've also read that adding port forwarding might help. Just not sure what ports to forward. Some of the ranges I read were 5060 - 5061 (UDP) and 10000 - 20000 (UDP).
The only way I've ever been able to solve this issue was to set the devices up like this....
Often, with the above settings enabled, I find it may not be necessary to port forward or trigger. I myself tend to enable Port Triggering on my Router. For most Cisco ATA's, you will trigger or forward the following ports: SIP: 5060 - 5061 RTP: 16384 - 16538 Most VoIP providers will work with SIP ports between 5060 - 5080 and RTP ports 10000 - 20000.
If, as you say, your SPA122 is working best directly behind your modem, then I might suggest you try what I have been doing for years. Operate the SPA122 essentially in parallel with your Router.
To do this, your ISP needs to enable 2 DHCP IP addresses on your account. Most ISP's that offer High Speed broadband service will include 2 DHCP IP address allocations. However, in order to enable the 2nd IP address (if included with your account), you may need to contact the ISP customer service and ask them to "activate" your 2nd allowed IP address allocation (I had to do this for my account).
Once your know your 2nd DHCP IP address is available and activated, all you need to do is connect a 4-port switch diectly to the LAN side of your ISP modem. Then connect your SPA122 to one of the switch ports. And, connect your NAT-Router to another of the available switch ports. Now, when all devices are rebooted, your modem should issue one WAN IP address to your SPA122 and another WAN IP address to your NAT-Router.
With this configuration, you don't have to worry about any port forwarding issues to the SPA122 from the modem (hopefully your ISP doesn't block any VoIP related ports).
This setup has worked very well for me for the past few years. The only down side is that in order to configure the SPA122, I have to plug my laptop directly into the SPA122 LAN port to do the configuration. (Yes, I could use remote administration, but I prefer not to enable that).
Good luck. I hope at least one of these suggestions are helpful.