I also tried the ismith suggestion using the following:
when CLIENT_ACCEPTED {
if { [TCP::local_port] == 25} {
switch [ IP::client_addr ] {
192.168.246.151 { snat 198.212.12.151 }
192.168.246.150 { snat 198.212.12.150 }
default { forward } {
log local0. "[ IP::client_addr ] snatted"}
}
}
}
This generates the following error:
Mar 16 12:45:55 tmm tmm[1615]: 01220001:3: TCL error: snat_mail - extra switch pattern with no body while executing "switch [ IP::client_addr ] { 192.168.246.151 { snat 198.212.12.151 } 192.168.246.150 { snat 198.212.12.150 } default { forward } { l..."