Relay a single TCP service through a fixed forward

Needs: A bindable pivot listener, source-to-listener access and pivot-to-destination connectivity

On a Linux pivot, expose one internal TCP service

# On a Linux pivot, expose one internal TCP service
socat -ddd TCP-LISTEN:LOCAL_PORT,bind=PIVOT_REACHABLE_IP,reuseaddr,fork \
  TCP:INTERNAL_HOST:INTERNAL_PORT

Loopback-only relay for another local tunnel stage

# Loopback-only relay for another local tunnel stage
socat -ddd TCP-LISTEN:LOCAL_PORT,bind=127.0.0.1,reuseaddr,fork \
  TCP:INTERNAL_HOST:INTERNAL_PORT

These checks run on different machines

Verify the listener on the pivot with ss -lntp | grep LOCAL_PORT. Run nc -nvz PIVOT_REACHABLE_IP LOCAL_PORT from the intended client to test client-to-pivot reachability. These checks run on different machines:

# These checks run on different machines
ss -lntp | grep LOCAL_PORT
nc -nvz PIVOT_REACHABLE_IP LOCAL_PORT

Verify → Verify application behavior through the listener and keep the transport's destination explicit.

If it fails → A working listener with no application response can be a pivot-to-destination failure. Dynamic RPC may need a different route. More detail ↓

If → then

SQL Server credentials or a Windows identity accepted by the database → Use SQL Server rights, impersonation and command facilities
Needs: Correct SQL versus Windows authentication; database role and configuration must permit the requested operation
A MySQL-compatible service and valid application/database credentials → Use MySQL/MariaDB data and file primitives
Needs: Database authentication and exact schema/file privileges; secure_file_priv and server filesystem identity constrain file actions
A credential appears valid but the destination's usable access is unknown → Match route, destination service and effective authorization
Needs: Real source-to-service route, correct identity context and protocol-specific execution/logon rights

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Relay a single TCP service through a fixed forward

USE WHEN: One reachable pivot can connect to one internal TCP destination
STARTING ACCESS: A pivot identity/process or reachable SSH service and a drawn source-to-destination path
RESULT: A reachable local/pivot port carrying one destination service

Recognize the clue

From pivot-state evidence identify one fixed TCP destination and where the assessment client can reach a pivot listener.

ip route get TARGET
ss -lnt

SYNTHETIC EXAMPLE OUTPUT

Pivot -> internal TARGET:PORT: verified
Assessment source -> pivot listener: candidate
Needed protocol: TCP, one fixed destination

Means: A single TCP service can fit a fixed relay without assuming a full routed network.

Confirm: Confirm both legs, bind address/permission and any additional dynamic ports or return path.

After validation: Both legs and the destination handshake work: choose a fixed TCP relay.
Ruled out in this context: The protocol needs unprovided UDP or dynamic connections: reject this one-port topology.
Still inconclusive: A listen socket without the destination handshake leaves the remote leg unknown.

Troubleshooting: A working listener with no application response can be a pivot-to-destination failure. Dynamic RPC may need a different route.

Additional prerequisite checks

ss -lnt
ip route get TARGET

On a Linux pivot, expose one internal TCP service:

Loopback-only relay for another local tunnel stage:

Verify the listener on the pivot with ss -lntp | grep LOCAL_PORT. Run nc -nvz PIVOT_REACHABLE_IP LOCAL_PORT from the intended client to test client-to-pivot reachability. These checks run on different machines:

fork handles multiple connections. reuseaddr eases rebinding after restart. Socat does not add authentication or encryption to this relay; bind narrowly and remove the process when finished. A listener can exist even when the pivot-to-destination connection fails.

Why it works

A fixed TCP relay transports bytes to a predetermined endpoint. It does not automatically carry UDP, DNS, dynamic RPC or callbacks.

Worked example · hypothetical

Observation: an internal database is reachable from the pivot. Test: create the selected fixed relay and use its listener from the assessment source. Illustrative output: the database handshake succeeds. Interpretation: validate its own credentials/rights next.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗