Setting up a direct external extension for 3CX has always been a bit of a lottery. It will work with some routers and not others. The 3CX proxu tunnel works OK but you need a computer to use it – also if the Internet connection drops either end it needs to be restarted manually sometimes.
I have used the following settings with SPA942, SPA921 and SPA504 phones with 100% success:

In the SIP tab
RTP Parameters
Note the RTP port range – this must be port forwarded in your router to the IP address of phone
RTP Packet Size = 0.020
NAT Support Parameters
Handle VIA recieved = yes
Handle VIA rport = yes
Insert VIA recieved = yes
Insert VIA rport = yes

To use STUN STUN Enable = yes
STUN server = stun.3cx.com (or any public STUN server)
EXT IP = blank
To use fixed IP STUN Enable = no
STUN server = blank
EXT IP = public IP of your 3CX system
Ext 1 tab

NAT Settings
NAT Mapping Enable = yes
NAT Keep Alive Enable – yes
Proxy and Registration
Proxy = public IP of 3CX system
Use Outbound Proxy = no
Subscriber Information
Display Name = display name
User ID = extensiom number
Password = password
Use Auth ID = yes
Auth ID = auth ID
Dialplan
Dialplan = [x*].
(note the dot in dial plan)
The only downside is that you have to port forward the RTP ports in your router – this is the bit that some router allow through without forwarding.