我在（最新的）Arch Linux 服务器上遇到了问题。我已经能够用 netcat 重现它。
如果我开始在我的服务器上收听：
ncat -l -p 2000 -k
接着
telnet (my local ip) 2000
从本地机器上，我可以看到双向连接。
但是，如果我从远程计算机上 telnet，则连接已建立，但我在服务器端键入的任何内容都不会出现在远程端。如果我在远程端输入一些东西，一旦按下 Enter，第一行就会出现在服务器端，但随后连接会以Connection closed by foreign host..
我能够确认此问题与我的路由器无关：将同一端口转发到另一台 Debian 机器一切正常。这会阻止 nginx 和其他服务器工作。
我目前没有任何 iptables 规则：
$ iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
猫：
# ncat -l -p 2000 -k -v
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Listening on :::2000
Ncat: Listening on 0.0.0.0:2000
Ncat: Connection from (remote public ip).
Ncat: Connection from (remote public ip):60990.
本地机器上的 tcpdump：
# tcpdump -nnvvS port 2000
tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:09:46.847867 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
(server local ip).2000 > (remote public ip).60990: Flags [S.], cksum 0x5399 (incorrect -> 0x8744), seq 1434025023, ack 276028935, win 65160, options [mss 1460,sackOK,TS val 422478433 ecr 3525397188,nop,wscale 7], length 0
13:09:46.870265 IP (tos 0x0, ttl 64, id 14989, offset 0, flags [DF], proto TCP (6), length 53)
(server local ip).2000 > (remote public ip).60990: Flags [P.], cksum 0x5392 (incorrect -> 0xa864), seq 1434025024:1434025025, ack 276028935, win 510, options [nop,nop,TS val 422478455 ecr 3525397212], length 1
13:09:49.931230 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
(server local ip).2000 > (remote public ip).60990: Flags [R], cksum 0x94ad (correct), seq 1434025024, win 0, length 0
远程机器上的 tcpdump：
# tcpdump -nnvvS port 2000
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
13:09:46.835291 IP (tos 0x10, ttl 64, id 59780, offset 0, flags [DF], proto TCP (6), length 60)
(remote public ip).60990 > (server public ip).2000: Flags [S], cksum 0xff3a (incorrect -> 0x4c94), seq 276028934, win 64240, options [mss 1460,sackOK,TS val 3525397188 ecr 0,nop,wscale 7], length 0
13:09:46.858924 IP (tos 0x0, ttl 48, id 0, offset 0, flags [DF], proto TCP (6), length 60)
(server public ip).2000 > (remote public ip).60990: Flags [S.], cksum 0xdbaa (correct), seq 1434025023, ack 276028935, win 65160, options [mss 1452,sackOK,TS val 422478433 ecr 3525397188,nop,wscale 7], length 0
13:09:46.858957 IP (tos 0x10, ttl 64, id 59781, offset 0, flags [DF], proto TCP (6), length 52)
(remote public ip).60990 > (server public ip).2000: Flags [.], cksum 0xff32 (incorrect -> 0x06ea), seq 276028935, ack 1434025024, win 502, options [nop,nop,TS val 3525397212 ecr 422478433], length 0
13:09:49.920045 IP (tos 0x10, ttl 64, id 59782, offset 0, flags [DF], proto TCP (6), length 58)
(remote public ip).60990 > (server public ip).2000: Flags [P.], cksum 0xff38 (incorrect -> 0x0603), seq 276028935:276028941, ack 1434025024, win 502, options [nop,nop,TS val 3525400273 ecr 422478433], length 6
13:09:49.941752 IP (tos 0x0, ttl 48, id 0, offset 0, flags [DF], proto TCP (6), length 40)
(server public ip).2000 > (remote public ip).60990: Flags [R], cksum 0xe90b (correct), seq 1434025024, win 0, length 0
