PUA_BLA fails for UA's registered behind NAT

I'm trying PUA_BLA with phones behind NAT. When the REGISTER arrives I do "fix_nated_register()" so the original Contact:
Contact: <sip:user@192.168.1.100:5060>
becomes:
Contact: <sip:user@192.168.1.100:5060;received=80.80.12.54:34567>

After that I do "bla_set_flag()" so PUA_BLA generates a SUBSCRIBE that should arrive to the UA, but PUA_BLA generates it:

SUBSCRIBE sip:user@192.168.1.100:5060

So this SUBSCRIBE will never arrive to the UAC since it's a private IP. The SUBSCRIBE should be sent to the "received" parameter (added before) but I don't know how to achieve it.

A dirty workaround is doing "fix_natted_contact()" before "bla_set_flag()" but this is a bad idea since it will change the stored Contact URI in "location" table (and normally UA's need to see their same private IP in
the RURI of requests sent from the proxy).

As a suggestion, PUA_BLA should take in account the "received" parameter added in Contact during registration to send the SUBSCRIBE.