I took the userland-network (slirp) code from qemu and plumbed it to the interface the to be natted clients were behind using pcap.