I finally got the best solution.

It was using net/userppp from pkgsrc. It has integrated NAT, and can
translate the packets destination address before they go to networking
stack. So "nat addr 10.0.0.1 127.0.0.1" solved my problem.

>
> You might have a way through hacking on pppd;  possibly using a plug-in.
> I'm not 100% sure, but it's an idea.
>

It was a very good idea. I've tried it too, before trying net/userppp.
Unfortunately, it was not possible.

There is a hook called "snoop_recv_hook" that pppd provides to its
plugins, and allows received packets to be modified, but I only could
receive packets in my hook when the connection was being established.

The explanation comes from pppd documentation: "IP packets go directly
to the kernel network code. So once pppd has negotiated the link, it
in practice lies completely dormant until you want to take the link
down, when it negotiates a graceful disconnect."


I hope this message can serve as future reference for someone.

Thanks a lot to all you at tech-net.

--
Paulo Matias