You need to set up Port Forwarding rules for SIP and RTP in the server via the Port Forwarding panel in the Server Manager. This will open and forward the ports.
So, for example you would forward udp port 5060 from your router (if you have one) to the SME server then port forward udp port 5060 from the server to the workstation IP.
Same for the RTP ports.
Unfortunately SIP and NAT do not work together very well. It can take a lot of trail and error to get the SIP device to work correctly. I am assuming in your case that the SIP device is a softphone.
You will need to make sure that the SIP device is set up to use either the VOIP providers STUN server or one of the public STUN servers.
There is plenty of info on SIP NAT transversal on the net
http://www.google.com/search?hl=en&q=sip%2Bnat&meta=If the VOIP provider provides an IAX2 service then use that instead of SIP. IAX2 is NAT aware and you only need to forward udp port 4569 to the VOIP device.
And yes, all udp connections will be shown in red in IPtraf. This is normal.
Jon