A opção -k deve fazer o truque.
Na página de manual de nc(1) :
-k Forces nc to stay listening for another connection after its
current connection is completed. It is an error to use this
option without the -l option.
Eu notei que o pacote netcat-traditional no Debian / Ubuntu não fica escutando como deveria. Nesse caso, use o pacote netcat-openbsd e tente novamente!
Como alternativa, use socat , que é mais direcionado ao seu uso de um servidor proxy. Um exemplo de TCP-forwarder aleatório da página manpage de socat , que precisa de algumas modificações, é claro.
socat -d -d -lmlocal2 \
TCP4-LISTEN:80,bind=myaddr1,reuseaddr,fork,su=nobody,range=10.0.0.0/8 \
TCP4:www.domain.org:80,bind=myaddr2
TCP port forwarder, each side bound to another local IP
address (bind). This example handles an almost arbitrary
number of parallel or consecutive connections by fork'ing a
new process after each accept() . It provides a little secu‐
rity by su'ing to user nobody after forking; it only permits
connections from the private 10 network (range); due to
reuseaddr, it allows immediate restart after master
process's termination, even if some child sockets are not
completely shut down. With -lmlocal2, socat logs to stderr
until successfully reaching the accept loop. Further logging
is directed to syslog with facility local2.