Comment by TekMol

Does it have to? The attack looks like it would also work over the internet:

    2. [ATTACKER] Route all packets destined for 172.16.0.0/12 through the victim's machine.

    ip route add 172.16.0.0/12 via 192.168.0.100

Here, "192.168.0.100" could be exchange for any ip address I guess?