diff --git a/Dockerfile b/Dockerfile
index e95c4e0..adde9ca 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,6 +15,7 @@ RUN \
     logrotate \
     nano \
     netcat-openbsd \
+    socat \
     sudo && \
   echo "**** install openssh-server ****" && \
   if [ -z ${OPENSSH_RELEASE+x} ]; then \
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-socat/run b/root/etc/s6-overlay/s6-rc.d/svc-socat/run
new file mode 100755
index 0000000..579c024
--- /dev/null
+++ b/root/etc/s6-overlay/s6-rc.d/svc-socat/run
@@ -0,0 +1,18 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+SOCAT_ENABLED=${SOCAT_ENABLED:-false}
+SOCAT_LISTEN_PORT=${SOCAT_LISTEN_PORT:-43388}
+SOCAT_TARGET_HOST=${SOCAT_TARGET_HOST:-localhost}
+SOCAT_TARGET_PORT=${SOCAT_TARGET_PORT:-43389}
+SOCAT_Log_Level=${SOCAT_LOG_LEVEL:--ddd}
+
+if [[ "${SOCAT_ENABLED}" != "true" ]]; then
+    echo "Socat service disabled. Set SOCAT_ENABLED=true to enable."
+    exec sleep infinity
+fi
+
+echo "Starting socat forwarding: LISTEN:${SOCAT_LISTEN_PORT} -> ${SOCAT_TARGET_HOST}:${SOCAT_TARGET_PORT}"
+exec /usr/bin/socat ${SOCAT_Log_Level} \
+    TCP-LISTEN:${SOCAT_LISTEN_PORT},fork,reuseaddr \
+    TCP4:${SOCAT_TARGET_HOST}:${SOCAT_TARGET_PORT}
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-socat/type b/root/etc/s6-overlay/s6-rc.d/svc-socat/type
new file mode 100644
index 0000000..5883cff
--- /dev/null
+++ b/root/etc/s6-overlay/s6-rc.d/svc-socat/type
@@ -0,0 +1 @@
+longrun
diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-socat b/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-socat
new file mode 100644
index 0000000..e69de29