Ircle and Firewalls FAQ


Introduction
Since a few months we are receiving more and more emails from people who got ADSL broadband connections or installed a small network in their home who cannot send files anymore using ircle, or who cannot connect to some IRC servers anymore. This document explains why this is happening and how it can be fixed.

Q: I recently got ADSL. I am able to receive files but I cannot send files anymore, what's wrong?

A: To explain this I first have to explain how files are transferred over IRC. When you are on IRC and you want to send a file to another person, you type /dcc send nickname and select a file to send.

More technically Ircle then determines the name of the selected file, the file size, it opens a passive connection on your Macintosh, determines its IP number and port number, and sends a specially encoded private message to the other user, which says:

"I am offering you a file named F that is B bytes in size. Connect to my IP number, which is x.x.x.x. I am waiting for you at port number P.".

When you are unfamiliar with the terms passive connection or port number read the following clarification:

  1. A passive connection (also called a listening connection) is not really a connection, it is a state of the network driver where it just listens for incoming network traffic from a certain host/IP number or just from any host. When a packet is received the owner of the listening connection (the application that created it) is notified and a real connection is established. From that moment on data can be exchanged.

  2. The reverse of a passive connection is: (you guessed it) an active or outgoing connection where the network driver tries to make a connection to a certain host by sending out packets. In other words it tries to connect to a passive connection of that host.

  3. Ports can be compared with slots or channels within a host. This allows multiple connections between 2 hosts without traffic being mixed up. Ports are just numbers in the range 1-65535. Ports below 1024 are reserved. Port numbers above 1023 can be freely used by applications. With any connection, either passive or active, there always is an associated port number.

  4. An example of this mechanism is a webserver. A webserver typically listens at port 80. When a user types the URL of that server in his webbrowser, the browser will make an active connection to port 80 of that server. When it answers the server will send the requested webpage and closes the connection. In the meantime the server opens another passive connection at port 80 to allow other users to connect as well.
After receiving the DCC offer the IRC client will simply try to open an active connection to the reported IP number and port P. If it succeeds the data of the file F is being transferred and after a while the connection is closed. You'll understand by reading the text above that a DCC offer can fail if the IP number and/or the port number in the DCC offer are not correct. If the wrong data is supplied the IRC client getting the DCC offer will just try to connect to the wrong host or port number and fails. This is exactly what happens when you have an ADSL connection.

Common ADSL implementations give your Mac an IP number in the 10.x.x.x range or 192.168.x.x range. There is something special about those IP number ranges: traffic from or to those hosts are not routed over the internet; When you try to connect to a host in the 10.x.x.x range your packets are stopped at the nearest router on the net.

So, when you are on ADSL and you offer a file to someone on IRC, the special private message with the DCC offer contains your local IP number, say 10.0.0.1. The receiving client then tries to connect to that host and immediately fails.

I now hear you think: "If I have such a strange IP number that is not being routed, how is it possible at all that I can surf the web and all?". Now this is where your provider does some work. Your provider has a so called Network Address Translation router (NAT router) installed between your ADSL modem and the internet. That device translates data packets from and to your host. It replaces the 10.x.x.x address which is present in each packet you send out with a real IP number and vice versa. So, when you open a connection to a webserver, the outgoing packets are modified so that they appear to come from a real IP number, the webserver replies to that address and reaches the router again. The router then modifies the incoming data, replacing the destination address with your local IP number.

But, DCC sends being a passive connection at your side, your ISPs router does not know about your intention to make another user connect to you. A passive connection does not send out packets, it just waits. Somehow you have to notify the intended receiver of your file that he has to connect to your ISPs router and not to your 10.x.x.x IP number which is normally in the DCC offer.

Now we're at the solution for the problem. There is an option in ircle, in the DCC preferences, called 'TIA/ADSL...'. This option allows you to modify the IP number in the DCC offer so that a real IP number is sent in the special private message, instead of the 10.x.x.x number. So when you enter the public IP number that you get when you are on the net, the user getting the DCC offer can connect to your ISP's NAT router and thus to you.

Because some ADSL implementations give you a different public IP number every time, and having to look up that number and enter it in the ircle preferences is annoying, I have added an extra 'Auto configure' option in ircle 3.1. This way ircle finds out what your public IP number is the first thing when you connect to an IRC server. It is the IP number (or associated hostname) with which you appear on IRC (in the userlist, in the /whois info etc.).

Fig 1. DCC Preferences of ircle 3.1.

dcc prefs


Q. But I do not have ADSL and I cannot send either. I do have IPNetRouter (or Airport base station) between my Mac and the internet connection.

A.IPNetRouter and AirPort are NAT (Network Address Translation) Routers. They modify incoming and outgoing data packets by replacing the destination or source IP address. Local IP addresses for your Mac(s) are typically in the 192.168.x.x or 10.x.x.x range, so when trying to DCC send you run into the same problem as with ADSL. See explanation above.

To fix the DCC problem you need to enable the 'TIA/ADSL...' checkbox in the ircle DCC preferences. In ircle 3.1 also check 'Auto Configure'. See Figure 1.

But you need to do an extra thing: selecting a DCC port range and add port mappings in the router. The DCC port range settings allows you to control what local port number ircle uses with DCC Sends. After you've added a port mapping in the router, which basically is a way to tell the router what to do with incoming connections to a certain port, you can make DCC work again.

In Figure 1 I have set my range to 33000..33003. That means that i can have 4 concurrent DCC sends running until all the ports are used up. The port numbers for the range can be picked from anything above 1023. Do not set a larger range than necessary. Only a few ports will do.

If you have more than one Mac behind your router, you have to make sure you select a different DCC port range with every Mac and add port mappings accordingly.

To edit Port Mappings for IPNetrouter, open your IPNetRouter preferences file with a text editor, such as SimpleText or BBEdit. You will see something like this:

Fig 2. IPNetRouter preferences file opened with BBEdit.

Ipnetrouter prefs

The lines you have to add are highlighted. You will recognize the port numbers. In this example the IP address of the Mac using that range is 192.168.1.2. Replace that with the IP address you are using. Furthermore you see mappings for other Macs in this preferences file, for instance the 32000-32002 for address 192.168.1.1. That Mac can now DCC too, using a different port range.

With the same technique you can enable ident (the protocol that determines your username on IRC). Look for the port mapping with port number 113. Note that you can only have one Mac use ident then.

When you save the file and launch IPNetRouter, your Port Mappings window looks like this:

Fig 3. IPNetRouter Port Mappings.

IPnetrouter port mappings

When you are using AirPort software, adding port mappings basically goes the same way. Figure 4 shows the addition of the ident port 113 for IP number 10.0.1.2. Only Airport software version 1.1 or newer supports this.

Fig 4. Airport 'Edit Port Mapping' Dialog.

airport edit port mapping

Fig 5. Airport Port Mapping Overview.

airport port mapping overview

Note: The port mapping method requires your Mac to have a fixed address so that the router always knows to which Mac it has to send incoming connection requests. If you have set up the router to use DHCP to give your Mac an IP address, port mappings probably will not work.

Routers other than IPNetRouter and Airport (there are many brands) might also have port mapping options. A router that is uncapable to do port mappings does not allow you to send files with ircle.


Q. As far as I know I have a real IP number for my Mac and there is no router at my place. I still cannot send files.

A.It is likely then that your provider is filtering incoming connections. This can only fixed by them, changing their routers configuration. Ask. It is uncommon for an ISP to filter incoming connections, but it does occur.


Q. I get 'install ident' when I connect to IRC server x. I thought ircle has ident, why isn't it working?.

A.Ident is the protocol with which the IRC server determines your username on IRC. The IRC client opens a passive connection at port 113, and the IRC server tries to connect to that. When you get 'install ident' message, the IRC server could not reach your Macs port 113. Some IRC servers require you have ident, others will let you log on, but your username will have a tilde (~) in front.

Probably you have a firewall/gateway between your Mac and the internet and you need to add a port mapping for ident. Create a port mapping in your firewall or gateway for TCP port 113 to your local IP number, port 113. See figures 2 and 3 for IPNetRouter and figure 4 and 5 for Airport.


Q. What ports does ircle use for audio and video streams?.

A.UDP ports 9000 (the sender) and 9001 (the receiver), plus one port for a regular DCC connection. That DCC port number can be set in the DCC Preferences.



IPNetRouter is a product by Sustainable Networks.
Airport is product by Apple Computer.