For the purposes of PCI-DSS compliance, I have been asked to see if there's a small consumer router/etc that can accept a packet from one network segment, and change the destination IP address (from itself to a new IP) and change the source address (from the original source to the router's IP), and then send it out on the second network segment.
As a (simplified) example:
I have a POS on IP 18.104.22.168
It "knows" about a credit card processing device on 22.214.171.124
It (the POS) sends a packet [from: 126.96.36.199] to 188.8.131.52
But 184.108.40.206 is actually a proxy router. The real credit card processing device is on 220.127.116.11.
The proxy router changes the destination IP to: 18.104.22.168, and, for the sake of compliance, changes the source address to 22.214.171.124, and passes that packet along to the actual credit card processing device.
The device processes the data, and sends a response back, [from: 126.96.36.199] to 188.8.131.52, which is, of course, the proxy router. The proxy router converts the source to 184.108.40.206 and the destination to 220.127.116.11 and sends it back along to the POS.
I know I can solve this in an ugly way with a pair of NAT routers hooked up back-to-back, but I'm hoping there's a more elegant fix.