能否利用邮件中继实现端口代理以解决IMAP 993端口封禁问题？

Yep, this relay approach works perfectly—here’s how to set it up using a few common tools, depending on what you have available in your environment:

方案1：用socat做轻量端口转发 #

socat is a super flexible tool for routing network traffic, perfect for quick, no-fuss setups.

• First, install socat on your intermediate host (use your system’s package manager: apt install socat for Debian/Ubuntu, yum install socat for RHEL/CentOS).
• Run this command to start the forwarder immediately:

  socat TCP-LISTEN:499,fork TCP:external-imap-server.com:993
  

  • TCP-LISTEN:499,fork tells socat to listen on port 499 and spin up a new process for each incoming connection.
  • TCP:external-imap-server.com:993 points to your target external IMAP server and its 993 port.
• To make this persist across reboots, wrap it in a systemd service:
  Create a file at /etc/systemd/system/imap-relay.service with this content:

  [Unit]
  Description=IMAP Relay to External Server
  After=network.target
  
  [Service]
  ExecStart=/usr/bin/socat TCP-LISTEN:499,fork TCP:external-imap-server.com:993
  Restart=always
  
  [Install]
  WantedBy=multi-user.target
  

  Then run these commands to activate it:

  systemctl daemon-reload && systemctl enable --now imap-relay.service
  

方案2：用Nginx做反向代理（生产级稳定场景） #

If you want a more configurable, reliable solution for long-term use, Nginx can act as an IMAP proxy easily.

• Install Nginx on the intermediate host (most default packages include the required ngx_stream_module).
• Edit your main Nginx config (e.g., /etc/nginx/nginx.conf) and add a stream block at the top level:

  stream {
      server {
          listen 499;
          proxy_pass external-imap-server.com:993;
          proxy_timeout 30m; # Matches typical IMAP idle timeouts
      }
  }
  

• Test the config for errors: nginx -t
• Reload Nginx to apply changes: systemctl reload nginx
• Don’t forget to open port 499 on the intermediate host’s firewall:
  • For UFW: ufw allow 499/tcp
  • For firewalld: firewall-cmd --add-port=499/tcp --permanent && firewall-cmd --reload

方案3：用SSH隧道（如果已有SSH访问权限） #

If you can SSH from your restricted server to the intermediate host, you can skip running a persistent service entirely with a local port forward.

• On your restricted server, run this command:

  ssh -L 499:external-imap-server.com:993 your-username@intermediate-host-ip
  

  This creates a local listener on port 499 of your restricted server—any traffic sent to localhost:499 will tunnel through SSH to the intermediate host, then forward to the external IMAP server’s 993 port.
• For a background tunnel (so you don’t need to keep the SSH session open), add -fN flags:

  ssh -fN -L 499:external-imap-server.com:993 your-username@intermediate-host-ip
  

Critical Checks to Run #

• Firewall Rules: Confirm the intermediate host allows incoming traffic on port 499, and outgoing traffic to the external IMAP server’s 993 port.
• Encryption: Since IMAP over 993 uses SSL/TLS, all these methods just pass encrypted traffic through—you don’t need to handle SSL termination here.
• Testing: From your restricted server, use openssl s_client -connect localhost:499 to verify you can reach the external IMAP server through the relay.

内容的提问来源于stack exchange，提问作者Barry Chapman