I have a rather special routing and NAT issue which I hope I can fix somehow. Inside my company we run a supernet like 192.168.0.0/21 (192.168.0.1 - 192.168.7.254) All computers have this subnet mask, without the need to route in order to reach any of the other computers inside this segment.
To some customers we have set up some IPSec tunnels between their and our firewall. Additionally some customers only accept traffic via the tunnel for certain source IP's from within my private network. Like customer A only accepts traffic to his servers (we have to reach for e.g. RDP, SAPGUI etc.) if the source is between 192.168.1.1-192.168.1.10. Another one only accepts source 192.168.3.0/24 and so forth. So far I handle this by assigning an IP from the range in charge to that specific client PC. But now this is becoming quite cumbersome and also it changes within the same day. The user needs to connect to customer A at 9 am and to customer B at 11 am....
In order to be more flexible I thought of centralizing this by having some router inside my lan which I tell that traffic to customer A should go thorugh interface A which has an IP of the required range. But also NAT the traffic in order to hide the real client source IP.
This way I could set up some specific routes for certein destinations to go through this router. I would eliminate the need of always switching client source IP's according to the needs. But I fear that I cannot make this work since my routing would be from the same into the same network again. It's not from my lan to the cusotmer lan, this is done via IPSec later on my firewall, but I just have to hide the client IP like 18.104.22.168/21 claiming to be 192.168.1.2/21
Any ideas? I thought of Windows RRAS Server, but this is good to route from one segment into another one. But inside the same network by just switching IP's.