For the purposes of PCI-DSS compliance, I have been asked to see if there's a small consumer router/etc that can accept a packet from one network segment, and change the destination IP address (from itself to a new IP) and change the source address (from the original source to the router's IP), and then send it out on the second network segment.
As a (simplified) example:
I have a POS on IP 126.96.36.199
It "knows" about a credit card processing device on 188.8.131.52
It (the POS) sends a packet [from: 184.108.40.206] to 220.127.116.11
But 18.104.22.168 is actually a proxy router. The real credit card processing device is on 22.214.171.124.
The proxy router changes the destination IP to: 126.96.36.199, and, for the sake of compliance, changes the source address to 188.8.131.52, and passes that packet along to the actual credit card processing device.
The device processes the data, and sends a response back, [from: 184.108.40.206] to 220.127.116.11, which is, of course, the proxy router. The proxy router converts the source to 18.104.22.168 and the destination to 22.214.171.124 and sends it back along to the POS.
I know I can solve this in an ugly way with a pair of NAT routers hooked up back-to-back, but I'm hoping there's a more elegant fix.