I see that I can run ./freeswitch -nonat to completely disable the use of UPnP.
But what if I only want FS to stop opening a path to its internal registration port (5060)? All the devices that I want to register are on my home network, behind the NAT, and I'd prefer not to expose the internal registration port to hackers until I need to. (And then, only after I have learned more about security measures that I can implement).