For the purposes of PCI-DSS compliance, I have been asked to see if there's a small consumer router/etc that can accept a packet from one network segment, and change the destination IP address (from itself to a new IP) and change the source address (from the original source to the router's IP), and then send it out on the second network segment.
As a (simplified) example:
I have a POS on IP 22.214.171.124
It "knows" about a credit card processing device on 126.96.36.199
It (the POS) sends a packet [from: 188.8.131.52] to 184.108.40.206
But 220.127.116.11 is actually a proxy router. The real credit card processing device is on 18.104.22.168.
The proxy router changes the destination IP to: 22.214.171.124, and, for the sake of compliance, changes the source address to 126.96.36.199, and passes that packet along to the actual credit card processing device.
The device processes the data, and sends a response back, [from: 188.8.131.52] to 184.108.40.206, which is, of course, the proxy router. The proxy router converts the source to 220.127.116.11 and the destination to 18.104.22.168 and sends it back along to the POS.
I know I can solve this in an ugly way with a pair of NAT routers hooked up back-to-back, but I'm hoping there's a more elegant fix.