PF is in the base system and pretty easy to configure for setups like
the one you describe -
Assuming your local net is NATed with unroutable addresses on the LAN,
the traffic is directed to a routable address but the computer you
want to receive the traffic is on a nonroutable address inside, some
basic redirection (rdr) should do the trick.
I'm a bit interested in why you should be looking for a different and
probably more difficult way to do it. Are there any specific things
in your setup which would break with PF?
--
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/http://www.datadok.no/http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.