Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the purposes of PCI-DSS compliance, I have been asked to see if there's a small consumer router/etc that can accept a packet from one network segment, and change the destination IP address (from itself to a new IP) and change the source address (from the original source to the router's IP), and then send it out on the second network segment.

As a (simplified) example:

I have a POS on IP

It "knows" about a credit card processing device on

It (the POS) sends a packet [from:] to

But is actually a proxy router. The real credit card processing device is on

The proxy router changes the destination IP to:, and, for the sake of compliance, changes the source address to, and passes that packet along to the actual credit card processing device.

The device processes the data, and sends a response back, [from:] to, which is, of course, the proxy router. The proxy router converts the source to and the destination to and sends it back along to the POS.

I know I can solve this in an ugly way with a pair of NAT routers hooked up back-to-back, but I'm hoping there's a more elegant fix.


share|improve this question
Any router that can run Linux (whether Tomato, OpenWRT, DD-WRT, or whatever) can do it. Dual NAT is implemented using iptables. You do the destination NAT in the pre-routing phase and the source NAT in the post-routing phase. – David Schwartz Dec 3 '12 at 21:06
Cisco ASA OS 8.3 and up can also accomplish this with "Twice NAT." However, Dennis's answer below is spot on in the sense that this sort of arrangement isn't security -- and warrants several questions back to your auditor. – Weaver Dec 4 '12 at 0:22
Thanks for the feedback. I hadn't thought about Tomato, etc, those are good ideas. And yes, I am very skeptical of the auditor's wisdom here, but attempts to convince them otherwise have fallen on deaf ears. – johnbr Dec 4 '12 at 15:23

You want your creditcard processing done behind consumer-grade devices? Why? And why the extra NAT, PCI-DSS has no such requirement. I suggest getting a different QSA or auditor instead so you don't have to do these things that don't make sense :)

share|improve this answer
You are preaching to the choir, sir. I personally think this is dumb, dumb, dumb. But the customer refuses to QSA shop, and so here we are. W.R.T. the consumer grade devices, they're just there for a few months, one of our vendors is cooking up a dedicated, hardened appliance just to solve this dual-NAT problem. It's astonishing how much money Fortune 500 companies will waste because two guys are golfing buddies. – johnbr Dec 4 '12 at 15:18
in that case, just grab your average openwrt capbale router and muck about with iptables until it works. Then run like the wind to find better clients :) – Dennis Kaarsemaker Dec 4 '12 at 16:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.