I setup a Linux NHRP Server and Linux NHRP Client with Kernel v3.2.57 (without VPN for now).  Even if I have no NAT in my lab, the NHS see the NHC behind a NAT with a unknown address:
opennhrp[3040]: Sending Registration Reply from proto src to (1 bindings accepted, 0 rejected)
Create link from ( to (
opennhrp[3040]: [] Peer up script: success
opennhrp[3040]: NL-ARP(tu1) is-at
opennhrp[3040]: Sending packet 4, from: (nbma, to: (nbma
opennhrp[3040]: Unknown NLmsg: 0x00000002, len 60
opennhrp[3040]: Received Purge Request from proto src to
opennhrp[3040]: Sending packet 6, from: (nbma, to: (nbma
If I understand correctly, NHRP receive this address from linux kernel via recvmsg().  I see a bug in kernel version 3.11 similar to this, but my understanding is that kernel 3.2.57 should not be affected by this bug?