Linux服务器上基于Nginx实现内部端口转发问题求助

Got it, let's work through this. The main reason your Nginx setup isn't working is simple: Nginx is designed primarily for HTTP/HTTPS traffic. When you're dealing with non-Web TCP/UDP requests (like your Python app's custom socket communication), the standard http block configurations won't do anything—Nginx will try to parse the traffic as HTTP, which obviously fails here.

Luckily, there are two solid alternatives that handle generic port forwarding perfectly, no Web protocol required:

方案一：用iptables（Linux系统级转发，推荐） #

This is the lightest, most efficient option since it's handled directly by the kernel, no extra software needed.

1. 开启IP转发 #

First, make sure your server allows IP forwarding (required for port redirects):

# 临时生效（重启后会重置）
echo 1 > /proc/sys/net/ipv4/ip_forward

# 永久生效，编辑sysctl配置
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

2. 添加端口转发规则 #

Redirect all TCP traffic coming into port 123 to port 1123 on the same server:

iptables -t nat -A PREROUTING -p tcp --dport 123 -j REDIRECT --to-ports 1123

# 如果你的应用用的是UDP协议，把tcp换成udp即可：
# iptables -t nat -A PREROUTING -p udp --dport 123 -j REDIRECT --to-ports 1123

3. 保存规则（避免重启后丢失） #

Save the iptables rules so they stick after a reboot:

• For Ubuntu/Debian: iptables-save > /etc/iptables/rules.v4
• For CentOS/RHEL: service iptables save（如果用firewalld则用firewall-cmd相关命令）

Once this is set up, any traffic to Server A's IP:123 will be silently forwarded to port 1123 at the kernel level. Your Python app won't even notice the difference—just keep connecting to the original IP:123 as before.

方案二：用socat（用户态转发工具，灵活可控） #

If you can't modify iptables (e.g., limited server permissions) or need more advanced forwarding logic, socat is a great tool for handling all kinds of socket traffic.

1. 安装socat #

# Ubuntu/Debian
apt-get install socat -y

# CentOS/RHEL
yum install socat -y

2. 启动转发服务 #

Run this command on Server A to forward port 123 to 1123:

socat TCP-LISTEN:123,reuseaddr,fork TCP:127.0.0.1:1123

• TCP-LISTEN:123: 监听123端口的入站连接
• reuseaddr: 允许服务停止后端口立即被复用
• fork: 为每个连接创建子进程，支持多客户端同时连接
• TCP:127.0.0.1:1123: 将流量转发到本地1123端口

要让服务在后台运行（退出登录后也保持）：

nohup socat TCP-LISTEN:123,reuseaddr,fork TCP:127.0.0.1:1123 &

或者配置成systemd服务实现开机自启：

cat > /etc/systemd/system/socat-port-forward.service <<EOF
[Unit]
Description=Socat Port Forward: 123 -> 1123
After=network.target

[Service]
ExecStart=/usr/bin/socat TCP-LISTEN:123,reuseaddr,fork TCP:127.0.0.1:1123
Restart=always

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl start socat-port-forward
systemctl enable socat-port-forward

额外：非要用Nginx怎么办？ #

Yes, but it's overkill unless you need features like logging or rate limiting. Nginx can handle TCP/UDP traffic with its stream module (大部分预编译的Nginx包都已包含这个模块）。

以下是针对你场景的极简配置：

stream {
    server {
        listen 123;
        proxy_pass 127.0.0.1:1123;
    }
}

把这段配置加到你的Nginx配置文件中（放在http块外部），然后重启Nginx即可。注意如果你的Nginx编译时没有加上--with-stream参数，这个配置会报错。

内容的提问来源于stack exchange，提问作者Momooo