Thanks Brian. Sorry, should have done a full sip trace before, but here is one now:

Calling an IVR dialplan:
http://pastebin.freeswitch.org/12634

Calling from one extn to another.
http://pastebin.freeswitch.org/12633
(With this one, the source/calling softphone gets a message on it saying put on hold by the other user - not sure if that helps.)

For what it's worth, at a couple of points when I was running the trace I was pressing keys to generate dtmf, and nothing changed on the screen - no activity at all.

Also, I've been able to remote desktop into a computer on another network, and install x-lite and it can connect to our internal server and works fine, but it can't do dtmf on the EC2 server either (so it's definitely a problem on the server end somehow, not my local network's NAT.)

Cheers,
Fraser