> [The next-hop address in the routing table] doesn't appear in the
> packets, it's only used to find the link-layer next hop address.  So
> you could make up a fake router address and add a static arp entry
> for that address on the relevant nic, and not use overlapping subnets
> at all.

Well, mutatis mutandis if it's not Ethernet (arp is an Ethernet thing).
I've done exactly this.  I have a setup in which a machine with a known
MAC address is connected via Ethernet, and the router has routes that
end up pointing the packets to 10.0.0.3 on that Ethernet - but with a
static arp entry so that it never actually arps for 10.0.0.3.  The
receiving host is blissfully unaware that the 10.0.0.3 address exists
anywhere.

It's kludgy.  It's relatively brittle.  It means rebooting the gateway
to change almost anything about it (I had to hack on various bits of
the arp support to make it work at all, and I can't take down some of
the things once they're set up).  But it works, in that packets flow
and the relevant machine is unaware that the hackery is present.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B