How to Install and Use socat in Linux for Port Forwarding, SSL Tunnels, and Network Relays

While traditional networking tools like netcat (nc) excel at simple socket piping and port listening, they lack native support for encrypted connections, bidirectional multithreading, and bridging diverse data channels like UNIX domain sockets or serial lines. The socat (SOcket CAT) utility is a multipurpose relay tool that establishes two independent bidirectional byte streams and transfers data between them. For system administrators, penetration testers, and DevOps engineers, socat is the definitive command-line tool for network redirection, port forwarding, and TLS proxying.

How socat Establishes Data Relays

The core concept behind socat is pairing two discrete data endpoints. An endpoint can be an open TCP socket, a UDP listener, a UNIX domain socket, standard input/output (STDIO), a named pipe (FIFO), or an SSL/TLS tunnel. socat reads data from the first address, writes it to the second address, and simultaneously forwards reverse traffic seamlessly.

Installation Instructions

On Ubuntu and Debian

sudo apt update
sudo apt install socat

On Fedora, RHEL, and Rocky Linux

sudo dnf install socat -y

On Arch Linux

sudo pacman -S socat

Step-by-Step Practical Examples

Step 1: Simple TCP Port Forwarding

To listen on local port 8080 and forward all incoming connections to an internal web server at 192.168.1.100:80:

socat TCP-LISTEN:8080,fork,reuseaddr TCP:192.168.1.100:80

• TCP-LISTEN:8080: Binds a local listening socket on port 8080.
• fork: Spawns a child process for each incoming client, allowing concurrent connections.
• reuseaddr: Allows immediate socket rebinding without waiting for timeout timeouts.
• TCP:192.168.1.100:80: The forwarding target destination.

Step 2: Creating an Encrypted SSL/TLS Tunnel

To securely forward traffic from an unencrypted local application to an encrypted external TLS server without modifying application source code:

socat TCP-LISTEN:9000,fork OPENSSL:secure.example.com:443,verify=0

Connecting to localhost:9000 now transparently proxies through an encrypted TLS handshake to the remote host.

Step 3: Bridging UNIX Domain Sockets to TCP

To expose a local Docker daemon socket (/var/run/docker.sock) over a local TCP network socket for remote debugging:

sudo socat TCP-LISTEN:2375,bind=127.0.0.1,fork UNIX-CONNECT:/var/run/docker.sock

Step 4: Interactive Reverse Shell for Diagnostics

To establish an interactive remote shell listener with full terminal emulation (TTY) support:

socat file:`tty`,raw,echo=0 TCP-LISTEN:4444

socat Address Types Reference

Address Keyword	Endpoint Type	Syntax Example	Typical Operational Role
TCP-LISTEN	TCP Server Listener	TCP-LISTEN:8080,fork	Creating local ingress proxies and port forwarders
TCP	TCP Client Connection	TCP:10.0.0.1:443	Connecting to remote backend services
OPENSSL-LISTEN	Encrypted TLS Listener	OPENSSL-LISTEN:443,cert=cert.pem	Terminating SSL/TLS in front of plaintext applications
OPENSSL	Encrypted TLS Client	OPENSSL:remote.com:443	Originating encrypted tunnels over insecure networks
UNIX-CONNECT	UNIX Domain Socket	UNIX-CONNECT:/var/run/app.sock	Bridging inter-process communication (IPC) to network sockets
STDIO / -	Standard Input/Output	-	Interactive command-line debugging and terminal piping

Security and Operational Notes

• Always Use fork: Omitting the fork parameter from listener endpoints means socat will handle exactly one connection and terminate immediately after the first client disconnects. Always include fork for standing proxies.
• TLS Certificate Verification: When testing in local environments, verify=0 suppresses certificate verification errors. In production security environments, configure cafile=/path/to/ca.crt to prevent man-in-the-middle attacks.
• Binding Interfaces: By default, TCP-LISTEN binds to all network interfaces (0.0.0.0). To restrict access exclusively to localhost, always specify bind=127.0.0.1.