DCC through a heavily firewalled ZNC? reddit / irc ---------------------------------------------------------------------- 13_0_0_0_0 · 2019-04-24 15:53 I'm running ZNC on a virtual host, with all ports locked down by the hosting service's firewall, only allowing ssh, my ZNC port, and ident from my home IP (all outbound connections are allowed). I have bouncedcc enabled for the user in ZNC. So far so good. I initiate a dcc transfer from a chan bot. In Weechat I see the xfer request, but when I accept the transfer and it immediately fails. When it comes to DCC I'm not really clear how connections are initiated (which direction, what ports are used, etc). Where would the breakdown be? Would it be my home firewall or the ZNC server's firewall? ---------------------------------------------------------------------- webvictim · 2019-04-24 23:07 As per https://en.wikipedia.org/wiki/Direct_Client-to-Client: The message format is `DCC SEND ` With a normal DCC transfer, the sender is responsible for giving its IP and a port, then opening that port up for the receiver (you) to connect to. This part should be fine, as the ZNC machine should be able to make an outgoing connection to the sender with no problem. The issue comes from using `bouncedcc` - ZNC will make the outbound connection to the IP:port on the remote server as usual, but then it will open up a random port on the server it runs on and rewrite the DCC message to tell your client to connect to the ZNC IP and the random port it opened instead. Your server only allows incoming connections on a few ports, so the connection fails. ---------------------------------------------------------------------- 13_0_0_0_0 · 2019-04-25 00:07 So if I relaxed my firewall rules and allowed all, my client should be able to make a connection to ZNC for the second DCC leg. I tried that, nada. What's interesting is, the IP I'll keep poking at it. ...aaaaand I'm an idiot. I just realized, I forgot I'm running it in a docker container. Unless I missed something, containers can't listen on unexposed ports, so my client can't connect to it. ---------------------------------------------------------------------- webvictim · 2019-04-25 00:11 If you relax the firewall rules on the ZNC server then yes, you should be able to connect. If there’s some way to specify a port range for `bouncedcc` and forward that with Docker and the firewall, even better.