For the purposes of PCI-DSS compliance, I have been asked to see if there's a small consumer router/etc that can accept a packet from one network segment, and change the destination IP address (from itself to a new IP) and change the source address (from the original source to the router's IP), and then send it out on the second network segment.
As a (simplified) example:
I have a POS on IP 188.8.131.52
It "knows" about a credit card processing device on 184.108.40.206
It (the POS) sends a packet [from: 220.127.116.11] to 18.104.22.168
But 22.214.171.124 is actually a proxy router. The real credit card processing device is on 126.96.36.199.
The proxy router changes the destination IP to: 188.8.131.52, and, for the sake of compliance, changes the source address to 184.108.40.206, and passes that packet along to the actual credit card processing device.
The device processes the data, and sends a response back, [from: 220.127.116.11] to 18.104.22.168, which is, of course, the proxy router. The proxy router converts the source to 22.214.171.124 and the destination to 126.96.36.199 and sends it back along to the POS.
I know I can solve this in an ugly way with a pair of NAT routers hooked up back-to-back, but I'm hoping there's a more elegant fix.