For the purposes of PCI-DSS compliance, I have been asked to see if there's a small consumer router/etc that can accept a packet from one network segment, and change the destination IP address (from itself to a new IP) and change the source address (from the original source to the router's IP), and then send it out on the second network segment.
As a (simplified) example:
I have a POS on IP 220.127.116.11
It "knows" about a credit card processing device on 18.104.22.168
It (the POS) sends a packet [from: 22.214.171.124] to 126.96.36.199
But 188.8.131.52 is actually a proxy router. The real credit card processing device is on 184.108.40.206.
The proxy router changes the destination IP to: 220.127.116.11, and, for the sake of compliance, changes the source address to 18.104.22.168, and passes that packet along to the actual credit card processing device.
The device processes the data, and sends a response back, [from: 22.214.171.124] to 126.96.36.199, which is, of course, the proxy router. The proxy router converts the source to 188.8.131.52 and the destination to 184.108.40.206 and sends it back along to the POS.
I know I can solve this in an ugly way with a pair of NAT routers hooked up back-to-back, but I'm hoping there's a more elegant fix.