Just thinking about this issue and #1297 a little and I have a question, when the registrar modules has "use_path" enabled, as we do here, is nathelper aware of this? If it is not, then, I'm guessing it will try to resolve the best interface to send over based on the "received" parameter, which, in our case, the OS will tell it to use the interface which has the default gateway, however, if nathelper is aware that we need to use the Path uri as the next hop, then nat helper does not need to decide which interface to use for the recieved parameter, it just needs to decide which interface to use for the destination in the Path uri. Could this be what is happening here?