I have been thinking about only accepting tcp/tls on the public profile and blocking udp at the border.The peer will have to do the 3 way handshake which means we know they have a valid source ip:port before they get up the sip stack
I'm sure this is not a new idea.