The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →ZNC keeps your IRC connection online after your desktop or mobile client disconnects. Install it on a Debian or Ubuntu VPS, run it as an unprivileged service account, enable a TLS listener, add your IRC networks, and then connect every client to the VPS instead of directly to IRC. Your upstream sessions remain connected while you are offline, so channel history and messages that ZNC buffers are available when you reconnect.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers the distribution-package installation first, a source-build alternative, systemd operation, TLS, firewall decisions, client authentication, and the failure modes that most often prevent a working bouncer.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat ZNC does on a VPS
ZNC is an IRC proxy daemon. It maintains a connection from the server to one or more IRC networks and presents a single endpoint to your IRC clients. When your client closes, ZNC stays connected upstream; when the client returns, it reconnects to the bouncer and resumes the session. Debian describes it as an advanced IRC bouncer that can maintain permanent connections to several networks and channels while appearing as one user to other IRC participants.
The VPS is useful because it has a persistent network connection and can run continuously, independent of your home computer, laptop sleep state, or phone battery. ZNC does not replace an IRC network account: it stores the network connection details, user credentials, channel list, and any configured SASL or password settings, then relays traffic between the network and your clients.
#1 Best Overall
Choose a deployment model before installing
| Approach | Best for | Maintenance | Service model | Upgrade path |
|---|---|---|---|---|
| Debian or Ubuntu package | Most VPS installations | Use the distribution package manager and security updates | Packaged systemd unit or a per-user daemon | Upgrade through normal distribution updates |
| Source build | A custom install prefix or features not exposed by the package | You maintain the build and installed files | You must design and maintain the service definition | Repeat the source build and preserve your configuration |
For Ubuntu 24.04 LTS, the Ubuntu package page lists ZNC version 1.9.0-2build3. Debian’s stable package page lists version 1.9.1-2, with updates shown on that page. Those values are distribution-specific and can change as repositories move; check the package page for the release installed on your VPS before pinning a version or writing automation.
Prepare the VPS safely
Use a supported operating system and an administrative account
Use a supported Debian or Ubuntu release and keep an administrative account with SSH access. Do not plan to administer the machine solely through a newly opened ZNC port. Keep an existing SSH session open while changing firewall rules so a mistaken rule cannot lock you out.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPlan the hostname and certificate
Choose a DNS name that resolves to the VPS if clients will connect over the public Internet. A stable hostname makes certificate replacement and client configuration straightforward. Decide which TCP port will be the ZNC listener and document it before creating firewall rules.
Protect secrets
ZNC configuration contains IRC usernames, passwords, network settings, and possibly SASL credentials. Its private key is stored in the ZNC PEM file. Restrict file ownership to the service account, keep backups access-controlled, and never paste these files into a public issue or chat log.
Install ZNC from Debian or Ubuntu packages
- Refresh the package index:
sudo apt update - Install ZNC:
sudo apt install znc - Confirm that the binary is available:
znc --version
The package route is the simplest choice for a VPS because dependencies, system integration, and future security updates come from the operating system. It also supplies Debian’s systemd unit, which starts ZNC in the foreground with a defined data directory.
Create the first configuration without running as root
ZNC’s first-run wizard is launched with znc --makeconf. The wizard asks for the listener, an administrator account, and initial network details. Do not run the daemon as root. The manual exposes --allow-root only as an override; using that override gives a network-facing service unnecessary access to the rest of the VPS.
Recommended Free Tools
Per-user configuration
For a personal, per-user daemon, switch to a dedicated non-root account and run:
znc --makeconfKeep the resulting data directory in that account’s home directory and start ZNC as the same account. This model is convenient when one person owns the installation, but you must arrange your own systemd unit or another reliable startup method.
Debian’s packaged daemon
For Debian’s packaged service, generate the configuration in the service data directory before enabling systemd. The Debian instructions use the service account and an explicit data directory:
sudo -u _znc znc --makeconf --datadir=/var/lib/zncAfter the wizard finishes, verify ownership of /var/lib/znc and its files. The packaged unit shown by Debian runs ZNC as user znc, while the configuration procedure uses _znc on Debian documentation. Account names and package revisions can differ, so inspect the installed unit and make the data directory readable and writable by the account named in that unit before starting the service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Important wizard choices
- Listen port: select an unused TCP port that you will permit through the VPS firewall.
- SSL/TLS: enable it for Internet-facing clients unless a separate, deliberately configured TLS proxy terminates encryption.
- Administrator username and password: use a long, unique password; this account can change networks, users, modules, and listeners.
- Initial IRC network: enter the network hostname and port supplied by that network. Add a network password or SASL settings when the network requires them.
- Channels: list channels ZNC should join automatically. Confirm the network’s channel names and registration requirements.
Enable and inspect the systemd service
Debian’s unit starts ZNC with --datadir=/var/lib/znc, runs it in the foreground, uses a dedicated service user, and orders startup after network.target. Enable it at boot and start it now:
sudo systemctl enable --now zncInspect the result immediately:
sudo systemctl status znc --no-pager
sudo journalctl -u znc -b --no-pagerA healthy status shows an active service. The journal is the authoritative place to find a malformed configuration, an unavailable port, an unreadable PEM file, or a permission failure. If the service exits, fix the first configuration error reported in the journal before repeatedly restarting it.
Rank #3
Configure TLS before exposing the listener
Understand the default certificate
ZNC supports SSL/TLS and can generate its certificate with:
znc --makepemDebian’s default setup uses a self-signed certificate. A self-signed certificate encrypts traffic but does not provide a trusted identity: clients normally display a warning or require you to approve a fingerprint manually. For a public VPS hostname, replace it with a certificate issued by a publicly trusted certificate authority and keep the private key readable only by the ZNC service account.
Match the certificate to the listener
During --makeconf, enable SSL for the listener and select the certificate file used by that installation. If you replace the certificate later, preserve the expected filename and permissions or update the listener configuration to the new path. Restart ZNC after changing certificate files, then confirm the service journal contains no key or certificate parsing error.
Limit network exposure
Allow only the selected ZNC listener port through the VPS firewall, and allow SSH on its existing port. Do not expose an unencrypted listener merely because it is easier to test. If you temporarily open an additional diagnostic port, close it as soon as testing ends.
Add IRC networks and channels
You can configure ZNC through WebAdmin or through IRC commands. WebAdmin is useful for the initial setup; IRC commands are practical once a client is connected. Add each network separately and provide:
- The upstream IRC hostname and port.
- TLS for the upstream connection when the network supports or requires it.
- The network password, NickServ password, or SASL mechanism required by that network.
- Channels that ZNC should join automatically.
- Any global or per-network modules you need, such as logging or playback behavior.
Keep upstream TLS and client-to-ZNC TLS conceptually separate. Encrypting the client connection does not automatically encrypt the connection from ZNC to the IRC network; configure the upstream network’s TLS options as well.
Rank #4
- 128GB ( 16GBx8 ) 1600 MHz ECC Reg 240pin Standard Voltage Dual Rank VLP Memory Module.
- Every module is backed by a lifetime limited warranty from the manufacturer. We always have hundreds in stock!
- Free technical support from our experienced technicians.
- Every single module is fully tested by the manufacturer and certified. These parts are not compatible with non-server computers.
- Compatible with most major brand servers. Not sure if your server is compatible? Feel free to contact us. Our experienced technicians can verify if these parts will work for you.
Connect an IRC client to ZNC
- Set the IRC server address to the VPS hostname.
- Set the port to the ZNC listener port chosen during configuration.
- Enable TLS in the client when the listener is configured for SSL.
- Authenticate with the ZNC username and password. The official ZNC documentation shows the server-password form as
username:password. - After authentication, select or confirm the configured network. The client then reaches the upstream IRC network through ZNC.
Some clients provide separate username and password fields; others require the combined username:password value in the server-password field. Use the format your client expects, and do not confuse the ZNC password with the password for NickServ or the upstream network.
Verify persistence and playback
- Connect one client and join a test channel through ZNC.
- Disconnect the client without stopping the VPS service.
- Wait for another IRC user or a second client to send a test message.
- Reconnect to the same ZNC listener and network.
- Confirm that ZNC remains connected upstream and that its configured playback or buffer behavior presents the missed conversation according to your module settings.
If the upstream session disappears when your client disconnects, the client is probably connecting directly to IRC, the network was not added to ZNC, or the ZNC service itself stopped. Check the service status and network settings before changing client passwords.
Operate and troubleshoot ZNC
The service will not start
- Read
sudo journalctl -u znc -b --no-pagerand correct the first reported error. - Check that the configured listener port is not already used by another process.
- Check ownership and permissions for the data directory, configuration, and PEM file.
- Confirm that the systemd unit’s service account matches the account that owns the files.
- Validate the configuration with a foreground diagnostic rather than guessing.
Run a foreground diagnostic
The ZNC manual documents -f and -D for foreground and debug operation. Stop the systemd service first, then run the diagnostic as the service account with the same data directory used by systemd. This keeps error output in your terminal and avoids two ZNC processes competing for the listener port. Start systemd again after correcting the problem.
The client cannot connect
- Confirm DNS resolves to the VPS address.
- Confirm the client uses the ZNC listener port, not the upstream IRC port.
- Confirm the VPS firewall and any provider-level firewall allow that port.
- Check whether TLS is enabled on both sides and whether the client trusts the certificate.
- Verify the ZNC username and password syntax, including the colon in
username:passwordwhen the client uses a single server-password field.
ZNC connects but the IRC network rejects it
- Recheck the upstream hostname and port.
- Enable upstream TLS when required.
- Re-enter the network password or SASL settings and verify the selected SASL mechanism.
- Check whether the IRC account must be registered, identified, or allowlisted before joining channels.
- Review ZNC’s network-specific status messages and the IRC network’s own connection policy.
Reload or rewrite configuration
The ZNC manual documents SIGUSR1 to rewrite the configuration and SIGHUP to reload it. Use signals only when you understand which file and service account are involved. For ordinary package-managed changes, a controlled service restart is easier to audit:
sudo systemctl restart znc
sudo systemctl status znc --no-pagerBackups, updates, and routine maintenance
Back up the complete data directory
Back up the ZNC configuration, user data, network definitions, and znc.pem together. A configuration backup without the private key may require certificate replacement; a key backup without the configuration does not restore networks and users. Store backups encrypted and test that you can restore them to a private, non-public location.
Apply distribution updates
For package installations, use the normal Debian or Ubuntu update process and review changes to the ZNC package and service unit. Package versions and dependencies change over time; the Ubuntu 24.04 and Debian stable versions cited above are snapshots, not a promise that a future update will retain those exact revisions.
Best Value
- 32GB ( 16GBx2 ) 1866 MHz ECC Reg 240pin Standard Voltage Dual Rank VLP Memory Module.
- Every module is backed by a lifetime limited warranty from the manufacturer. We always have hundreds in stock!
- Free technical support from our experienced technicians.
- Every single module is fully tested by the manufacturer and certified. These parts are not compatible with non-server computers.
- Compatible with most major brand servers. Not sure if your server is compatible? Feel free to contact us. Our experienced technicians can verify if these parts will work for you.
Review the listener and accounts
Remove unused ZNC users, networks, and modules. Rotate passwords after administrative access changes. Confirm that only the intended listener port is reachable from the Internet and that SSH remains restricted according to your VPS policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build ZNC from source when the package is insufficient
A source build is appropriate when you need a custom installation prefix or a feature unavailable in your distribution package. It trades package-manager simplicity for responsibility: you must provide build dependencies, choose where files are installed, create a service definition, and rebuild when security or compatibility fixes are released.
Use the official CMake workflow
- Obtain the ZNC source tree for the version you intend to run.
- Create a separate build directory and enter it.
- Configure the build with CMake, selecting a prefix if required:
cmake .. - Compile it:
make - Install it into the chosen prefix:
sudo make install
The exact CMake options and dependencies depend on the source version and enabled features. Keep the source tree, CMake configuration, compiler output, and install prefix recorded so the build can be reproduced. Do not overwrite a package-managed installation with an ad-hoc source install unless you have a rollback plan.
Run the source build as a dedicated account
Create or choose a non-root service account, place its data directory outside the source tree, and run znc --makeconf as that account. If you write a custom systemd unit, run ZNC in the foreground, set the same data directory explicitly, declare the service user, and order startup after networking. Test the unit with systemctl status and journalctl before enabling it at boot.
Package or source build: a practical decision
| Question | Choose the distribution package when… | Choose a source build when… |
|---|---|---|
| Do you need the quickest reliable install? | You want apt to install dependencies and integrate systemd. |
You can maintain build dependencies and service files yourself. |
| How will you receive updates? | Through Debian or Ubuntu package updates. | By tracking ZNC source releases and rebuilding the custom prefix. |
| How much control do you need? | The packaged version and enabled modules meet your needs. | You require a custom prefix, compile-time option, or newer source than the distribution offers. |
| Who owns the service? | The distribution unit defines the service account and data directory. | You define and document the account, paths, permissions, and unit. |
Security checklist before handing the VPS to users
- Run ZNC as a dedicated non-root account; never use
--allow-rootfor routine operation. - Use TLS for client connections and replace the Debian self-signed certificate on a public hostname.
- Permit only SSH and the required ZNC listener through the firewall.
- Use unique ZNC administrator and user passwords.
- Protect the configuration directory and
znc.pemfrom other local users. - Configure upstream IRC TLS and authentication independently of client-to-ZNC TLS.
- Back up configuration and key material securely, then test restoration.
- Inspect systemd status and the journal after installation, upgrades, and certificate changes.
- Apply operating-system and ZNC package updates promptly.
Version and documentation notes
ZNC documentation pages identify generated API documentation for version 1.9.8. That metadata describes the documentation build; it is not evidence that 1.9.8 is the newest release or the version installed by Debian or Ubuntu. Use the package metadata for your operating-system release and the ZNC documentation that matches the binary you actually deploy.
Frequently Asked Questions
Can I run ZNC as root on my VPS?
You should not. Create the configuration and run the daemon as a dedicated non-root account. ZNC exposes --allow-root only as an override, and a network-facing IRC proxy should not have root privileges.
Do I need a public DNS name for ZNC?
No, a client can connect to the VPS address, but a stable hostname is strongly preferable when you use a trusted TLS certificate. The certificate name should match the hostname clients use.
Why does my IRC client show a certificate warning?
Debian’s default ZNC certificate is self-signed. Replace it with a certificate from a publicly trusted authority for an Internet-facing hostname, or deliberately pin and verify the self-signed certificate on every client.
What is the difference between the ZNC password and the IRC network password?
The ZNC password authenticates your client to the bouncer, commonly as username:password in a server-password field. The network password or SASL credentials are separate settings that ZNC uses when it connects upstream.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
