and even on layer3 its not so simple to do this, it would require either a lot of netfilter hooks and perhaps some hacking.

another way to do this is if you were using linux on the end dst_ip server with a broken tcp stack (like kern 2.2 for example). you could use nginx to perform mnm spoof connections ... but this will not work as of like 3 years ago =)