Thanks for the sub - there's a bit more in there in terms of error checking than I would probably have thought of. Something like this combined with Corion's monkey-patch approach may yet be the "best" solution.

I really don't want to go putting nginx (or anything else) in front of this. It would add no real value that I can see and would be no more stable than the simple netfilter port-forwarding already under consideration.