You can run a production UnrealIRCd 6 network on a Debian 11, 12, or 13 VPS by compiling the supported 6.x series as a dedicated, unprivileged user, configuring a trusted TLS listener, opening only the ports you use, and managing the daemon with systemd. The essential sequence is: install build dependencies, compile and install UnrealIRCd, edit the shipped example configuration, pass ./unrealircd configtest, test by IP, then enable the supplied systemd unit.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers a single-server public network, encrypted client access on TCP 6697, optional plaintext migration on TCP 6667, DNS, firewalls, safe rehashes, and the separate Anope installation required for NickServ and ChanServ.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat you need before installing
Prepare the VPS before downloading source code. Use a current Debian 11, 12, or 13 installation with a public IPv4 address, console or SSH access, and enough storage for the source tree, build files, logs, and backups. A DNS name such as irc.example.net should eventually point to the VPS address with an A record, but you can test against the address first.
Keep the operating-system administrator account for maintenance only. UnrealIRCd should compile and run under its own low-privilege account. If the VPS provider supplies a network firewall or security-group interface, plan to configure it as well as Debian’s local firewall; allowing a port in only one of those places is not sufficient.
Supported release and package differences
UnrealIRCd 6 is the project’s stable, supported series and has been the stable series since December 2021. Check the official release page when you install rather than copying an old patch number into a script. The documented compiler dependencies differ slightly by Debian release:
| Debian | Packages required by the official build guide |
|---|---|
| 11 or 12 | build-essential, pkg-config, libssl-dev, libpcre2-dev, libargon2-0-dev, libsodium-dev, libc-ares-dev, and libcurl4-openssl-dev |
| 13 | build-essential, pkg-config, libssl-dev, libpcre2-dev, libargon2-dev, libsodium-dev, libc-ares-dev, and libcurl4-openssl-dev |
The Argon2 development package is the important version-specific change: Debian 11 and 12 use libargon2-0-dev, while Debian 13 uses libargon2-dev. Installing the wrong name causes an otherwise healthy apt-get command to fail.
Prepare Debian and a dedicated account
- Patch the operating system. From a root or sudo shell, run
apt-get updatefollowed byapt-get upgrade. Reboot if the kernel or other core components were upgraded, then reconnect over SSH. - Create the service account. For example, create an account named
unrealircdwith no administrative role. Do not build or run the IRC daemon as root. - Install the build tools. On Debian 11 or 12, run:
sudo apt-get install build-essential pkg-config libssl-dev libpcre2-dev libargon2-0-dev libsodium-dev libc-ares-dev libcurl4-openssl-devOn Debian 13, substitute
libargon2-dev:sudo apt-get install build-essential pkg-config libssl-dev libpcre2-dev libargon2-dev libsodium-dev libc-ares-dev libcurl4-openssl-dev - Restrict SSH separately. Keep SSH reachable for administration, but limit it to the addresses or access method you actually use. Do not expose database, compiler, or unrelated management ports just because the VPS firewall permits them.
Switch to the service account for the remainder of the build. A typical administrative command is sudo -iu unrealircd. The official installation guidance specifically expects a VPS administrator to create this account and perform the build as that user.
Download, compile, and install UnrealIRCd 6
Download the current UnrealIRCd 6 release archive from the project’s official download page while logged in as the dedicated account. The exact archive name changes with each release, so do not hard-code an obsolete patch version. After downloading, inspect the filename and extract it in the account’s home directory.
- Extract the archive. A wildcard handles the changing patch number:
tar -xf unrealircd-6*.tar.gzIf the archive uses a different compression suffix, use the matching
taroption or extract it with the archive utility supplied by Debian. - Enter the release directory. Use
cdfollowed by the directory created by extraction. Confirm that it contains theConfigscript before continuing. - Run the configuration script.
./ConfigAccepting the documented defaults is a reasonable first installation. Review each prompt instead of blindly changing paths; the resulting layout is used by the supplied example configuration and startup unit.
- Compile.
makeThe build must finish without compiler or linker errors. Missing headers almost always mean a development package from the dependency list was omitted.
- Install into the account’s home directory.
make install - Change to the installed tree. The normal destination is
~/unrealircd:cd ~/unrealircdRun operational commands from this installed directory, not from an old source tree that may remain beside it.
Keeping the source archive and installed tree separate makes upgrades easier: compile a new release in its own directory, verify its configuration, and retain the old installation until the replacement is known to start correctly.
Build the initial server configuration
Start with the example configuration shipped by UnrealIRCd. It demonstrates the syntax for server identity, operators, client authentication, messages, and listeners. Copy it to the active configuration filename if the installation does not already provide one, then edit that copy rather than inventing a configuration from an empty file.
Set a real server identity
Choose a fully qualified server name, for example irc.example.net, and create a DNS A record that points to the VPS public IPv4 address. Set a separate network name that users will recognize, such as Example Chat Network. The server name in the configuration, certificate hostname, and DNS record should agree; mismatches produce confusing client warnings.
Create an operator account safely
Define an administrator or IRC operator block in the configuration and use a strong password hash, never a plaintext password. Generate the hash from the installed directory:
./unrealircd mkpasswdPaste the generated value into the operator block and protect the configuration file with filesystem permissions that prevent ordinary users from reading it. Use a distinct operator credential rather than reusing the VPS, SSH, or email password.
Choose client authentication rules
The example configuration contains the client authentication policy. Decide whether your network permits unauthenticated connections, requires a server password, or restricts access by address. Keep the default policy only after reading it: an IRC server that accepts every connection can attract abuse, while an over-restrictive mask can lock out legitimate clients.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Customize MOTD and rules files
Set the message-of-the-day and rules files to explain your network name, conduct expectations, contact address, and whether TLS is required. Keep these files concise and update them whenever connection policy changes. Their paths must match the files present in ~/unrealircd.
Define listeners
A normal public setup has a TLS listener on TCP 6697. During a migration you may also retain plaintext TCP 6667, but expose only listeners you intend to support. The TLS FAQ shows this basic form:
listen {
ip *;
port 6697;
options { ssl; };
}Use the exact syntax and surrounding options from the shipped example for your release. Clients must explicitly select SSL/TLS when connecting to 6697; a normal plaintext connection to that port will fail.
Configure trusted TLS access
Use a certificate issued by a trusted certificate authority, such as a current Let’s Encrypt certificate, rather than a self-signed certificate for a public network. A trusted certificate prevents the browser-like trust errors that many IRC clients display and lets users verify that they reached your hostname.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Point UnrealIRCd at the certificate and key
Set the certificate-chain and private-key paths in the TLS options of the listener configuration. The UnrealIRCd account must be able to read the files, while the private key should not be world-readable. If your certificate renewal process replaces files atomically, ensure the daemon can read the renewed paths before every reload.
Choose migration or TLS-only operation
| Policy | Listeners | When it fits | Trade-off |
|---|---|---|---|
| Migration | TCP 6667 plaintext and TCP 6697 TLS | You still have users or clients that cannot use TLS. | Plaintext sessions expose credentials and messages to network observers. |
| TLS-only | TCP 6697 TLS | You control the client instructions and require confidentiality. | Legacy clients that lack TLS cannot connect. |
Starting with UnrealIRCd 6.2.0, the project’s SSL/TLS guidance actively encourages administrators to close plaintext 6667 and use TLS on all client ports. If you adopt that policy, remove or disable the 6667 listener, close the corresponding firewall rule, and tell users to select the +6697 endpoint in their IRC client.
Validate before starting the daemon
Never restart a live network immediately after editing the configuration. From ~/unrealircd, run:
./unrealircd configtestThis checks the configuration without starting the daemon. Fix every blocking error and investigate warnings, then repeat the command until it passes. Run the test after certificate-path changes, listener edits, upgrades, or changes to MOTD and rules files. A passing test proves that the parser accepts the files; it does not prove that an external firewall or DNS record is correct.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Open only the required network ports
Permit the ports configured in your listener blocks in both layers of filtering:
- Debian’s host firewall: add TCP 6697, and TCP 6667 only if plaintext is deliberately retained. If you use UFW, the equivalent rules are
sudo ufw allow 6697/tcpand, when needed,sudo ufw allow 6667/tcp. Adapt the commands if your host uses nftables or another firewall manager. - VPS provider firewall or security group: add the same TCP ports there. A provider-level deny overrides a permissive Debian rule.
- SSH: retain your restricted administration rule; do not remove it while testing IRC access.
Do not open arbitrary ranges for IRC. If you later add server-to-server links or monitoring endpoints, document and firewall those ports separately.
Test by IP, then by hostname
- Start the daemon locally or through systemd and connect an IRC client to the VPS public IP on 6697 with SSL/TLS enabled. If you deliberately kept plaintext, test 6667 separately.
- If the IP connection fails, check the daemon status, listener definitions, local firewall, and provider firewall before touching DNS.
- Once the IP works, connect to
irc.example.net. If the hostname fails while the IP works, correct the DNS A record and wait for the record’s previous cache lifetime to expire. - Check that the certificate covers the hostname users enter. A certificate for a different name can make an otherwise reachable TLS service appear broken.
Run UnrealIRCd at boot with systemd
The source tree includes a systemd unit under extras/startup. Use that supplied unit rather than creating an ad-hoc background process.
Recommended Free Tools
- From the source tree, enter the startup directory:
cd extras/startup - Edit
unrealircd.service. SetUser=andGroup=to the dedicated account, and setExecStart=to the installed daemon path under/home/unrealircd/unrealircd. Match any working-directory or environment paths to your installation. - As an administrator, install the unit and reload systemd:
sudo cp -av unrealircd.service /etc/systemd/system/
sudo systemctl daemon-reload - Enable it for future boots and start it now:
sudo systemctl enable unrealircd.service
sudo systemctl start unrealircd.service - Inspect the result:
sudo systemctl status unrealircdRead the UnrealIRCd logs as well as the systemd status output when startup fails.
Once systemd owns the process, use systemctl start unrealircd, systemctl stop unrealircd, and systemctl restart unrealircd for lifecycle control. Avoid launching a second copy manually from the shell; two daemons competing for the same listener can look like a firewall problem.
Apply configuration changes without an unnecessary restart
After editing unrealircd.conf, MOTD, rules, or certificate references, use this sequence:
- Save the files and verify ownership and permissions.
- Run
./unrealircd configtest. - If it passes, run
./unrealircd rehashfrom~/unrealircd. An IRC operator can also issue the IRCREHASHcommand. - Inspect notices and logs for rejected directives, failed certificate reads, or listener changes.
- Reconnect a test client and verify the changed behavior.
A rehash loads changed files without a full process restart. If a change affects a startup-only setting or the daemon still reports the old state, schedule a controlled systemctl restart unrealircd after another successful configuration test.
Add NickServ and ChanServ only when you need them
UnrealIRCd’s core does not include NickServ or ChanServ. It can run a minimal network without services. Add a compatible services package only if you need registered nicknames, registered channels, persistent topics, account controls, or recovery features.
Free tools Windows power users keep installed
One-click scans. No signup required.
What Anope adds
Anope is documented as compatible with UnrealIRCd. It runs as a separate services process and requires coordination between the two programs. Installation, database storage, service accounts, and upgrades belong to Anope rather than the IRCd package.
Link the services server
Configure a server-to-server Link block for the Anope services identity, matching the shared credentials and network addresses on both sides. Add the services identity to ULines so service clients receive the privileges they require, and set set::services-server to the exact services server name used by Anope. Follow the services documentation’s syntax for your installed versions instead of copying an example with mismatched names.
After adding the Link, ULines, or services-server settings, run ./unrealircd configtest, rehash, and inspect both UnrealIRCd and Anope logs. If users see “NickServ” or “ChanServ” as unknown commands, the services process is not installed, linked, or online; those commands are not supplied by the IRCd core.
Troubleshooting by symptom
No listener appears
- Run
./unrealircd statusfrom the installed directory and checksystemctl status unrealircd. - Inspect logs for a syntax error, an unreadable certificate key, or a port already occupied by another process.
- Compare the configured listen blocks with the socket-listening output available on your Debian system. Confirm that the daemon is bound to the expected address and port.
TLS clients refuse the connection
- Verify that the certificate and key paths are correct and readable by the service account.
- Confirm that the certificate covers the hostname users enter and includes the proper chain.
- Ensure the client is explicitly using SSL/TLS on 6697, represented in many clients as
+6697. - Replace a self-signed certificate with a trusted certificate if clients reject it. A self-signed certificate can be useful for private testing but is a poor public default.
Local connections work, remote connections fail
Check Debian’s firewall and the VPS provider’s firewall or security group independently. Test the public IP from a separate network; a local test can succeed even when inbound traffic is blocked upstream.
The IP works but the hostname does not
Correct the DNS A record so it points to the VPS public IPv4 address. Also check that the TLS certificate name matches the hostname. Do not use a stale hostname in the IRC client while troubleshooting the network path.
Edits appear to be ignored
Run ./unrealircd configtest, then ./unrealircd rehash. Read the notices and logs for a misspelled directive, a file path outside the installation, or a rejected value. A successful text edit alone does not reload a running daemon.
The service fails after reboot
Run systemctl status unrealircd and inspect the unit’s User=, Group=, ExecStart=, and working-directory values. Confirm that the installed tree, configuration, certificate, and key are available at boot and readable by the configured account. Use journalctl or the UnrealIRCd logs to identify the first startup error rather than repeatedly restarting.
Deployment choices at a glance
| Decision | Option A | Option B | Practical implication |
|---|---|---|---|
| Installation | Compile the supported source release | Use a prebuilt distribution package | Source compilation follows the project’s documented dependencies and keeps the UnrealIRCd 6 version current; package availability and freshness depend on Debian repositories. |
| Client transport | Plaintext 6667 plus TLS 6697 | TLS-only 6697 | The first eases migration; the second protects all client sessions and follows the post-6.2.0 recommendation to close plaintext. |
| Startup | systemd | cron or a manual shell launch | systemd provides boot ordering, status, logs, and consistent start/stop/restart operations; cron is more portable but less integrated. |
| Services | No services | A compatible services package such as Anope | No-services deployments have a smaller footprint; services add NickServ, ChanServ, registration, and account management but require a separate linked process. |
The official documentation does not publish a current performance benchmark, capacity figure, or cost comparison for these choices. Select based on security, compatibility, administration, and the features your community actually needs.
Quick Recap
Operational checklist
- Debian is patched and the UnrealIRCd account is not privileged.
- The correct Debian-specific Argon2 development package is installed.
- The current UnrealIRCd 6 archive was compiled with
./Config,make, andmake install. - The installed
~/unrealircdtree contains the active configuration and message files. - The server name, DNS A record, certificate hostname, and network identity agree.
- An operator password hash was generated with
./unrealircd mkpasswd; no plaintext operator password is stored. - The 6697 TLS listener is configured and tested; 6667 is closed unless migration requires it.
- Both Debian and provider firewalls allow only the selected TCP ports.
./unrealircd configtestpasses before every start, restart, or rehash.- The supplied systemd unit uses the correct user, group, and executable path and is enabled.
- Anope is installed and linked only if registered accounts and channels are required.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
