I've a Linux box with 3 network adapaters, which I'd like to configure as follow:Adapter A is connected to computer AAdapter B is connected to computer BAdapter C is connected to the Internet. Specifically, to someserver.comWhat I want to acheive:All traffic from A will go to the InternetDefine a special secret port on Adapter BTCP traffic coming from Computer B going to 'someserver.com' on 'secret port' will masquerade its source IP to appear as it is coming from Computer ATCP traffic coming back from 'someserver.com' going to Computer A to the same port used in #3, will redirect to computer B.Do I need to implement a router or a bridge? Can I do it merely by configuring NetFitler/ip tables or should it implement some code? If code, at which layer to I integrate with the IP stack?
Bridge/Router with custom logic
networking;iptables;routing;bridge;nat
For general access, you'll have to use MASQUARADE / SNAT (depending if your IP address on C is dynamic or static).So let's say current situation is your computer A has static IP address a.a.a.a, and your computer B has static IP address  b.b.b.b. Both have default gateway to computer C. And Someserver.com has static IP address r.r.r.r and secret port is pppp. You would configure computer C as router, which would have its default route to the Internet interface C (it already does that, either via static configuration, or being dynamically setup via PPPoE, etc). That by itself will accomplish 1.Now, you have two possibilities:make computer A router too.Then you change computer B config so its default route is via computer A (and not computer C as before), and  configure computer A like this:iptables -t nat -s b.b.b.b -d r.r.r.r -p tcp --dport pppp -j SNAT --to a.a.a.athat would make all TCP packets from source IP b.b.b.b going to destination IP r.r.r.r and destination port pppp pretend like they're coming from a.a.a.a, thus accomplishing 3, and traffic from someserver.com will go back to what was source address (a.a.a.a), which would be decoded by computer A and sent back to computer B. (thus accomplishing 4)That is easier, but requires that you computer B is running OS that is capable of such NAT policies.change computer A to have private IP like 10.0.1.100/24 and computer B to have private IP 10.0.2.100/24. Then on computer C do:ip addr add a.a.a.a/nn dev ifaceCip addr add b.b.b.b/nn dev ifaceCiptables -t nat -s 10.0.1.100 -j SNAT --to a.a.a.aiptables -t nat -s 10.0.2.100 -d r.r.r.r -p tcp --dport pppp -j SNAT --to a.a.a.aiptables -t nat -s 10.0.2.100 -j SNAT --to b.b.b.bwhere nn is your netmask and ifaceC is name of your interface C. That would put computer A and computer B in private ranges, thus allowing computer C to NAT computer A to a.a.a.a (so it behaves like before), and NAT computer B either to a.a.a.a (if dst=r.r.r.r, dport=pppp condition is met) or to b.b.b.b (otherwise).This does not require any special support on computer A nor computer B, but puts them behind NAT which might affect some other things. And of course, it this age it should be mentioned that above will only work for good ol' IPv4 addresses (the last of which are rapidly being used up) and not on IPv6