[SR-Users] Call pickup through a NAT

Hi All, I've hit my next stumbling block on my mission to get BLF/Call pickup working on Linksys/Cisco phones which are behind a NAT working with Kamailio. I'm using RFC 3265 and pua_dialoginfo to handle subscribes from phones and generate notify packets on status change. The phones are on two different sites behind a couple of NATs. Kamailio is on public IP in the data centre. BLFs work fine. However the <target uri="x.x.x.x."> given in the XML of the notify packet is the that of the Public IP of the NAT so that call pickup fails. I'm guessing that this actually needs to be the address of the Kamailio server? I cannot see where to correct this without breaking tables the server needs to know how to contact the phone when it needs to. Has anyone seen this before? Cheers Mark