You can run a public UnrealIRCd 6 network on a Debian 11, 12 or 13 VPS by compiling the supported 6 series, configuring it under a dedicated unprivileged account, exposing a TLS listener on TCP 6697, and managing the daemon with systemd. The safe sequence is: prepare the VPS, install the matching development libraries, build UnrealIRCd from its release archive, configure and test it, open only the required firewall ports, then add services such as NickServ and ChanServ only if your network needs them.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What this setup provides
This guide produces a conventional single-server IRC deployment. UnrealIRCd handles client connections, channels, operators, bans and the IRC protocol. It does not provide registered nicknames or channels by itself; those functions come from a separate services package such as Anope.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- A dedicated Linux account owns the source tree, configuration, logs and running process.
- The supported UnrealIRCd 6 series is compiled locally instead of relying on an old distribution package.
- Clients connect over encrypted IRC on TCP 6697 using a certificate whose name matches the server hostname.
- Plaintext TCP 6667 is optional and should be retained only while migrating clients or when you have a specific compatibility reason.
- systemd starts the daemon after boot and provides standard start, stop, restart and status controls.
UnrealIRCd 6 has been the project’s stable series since December 2021. Check the current release archive when you install rather than copying an obsolete patch number into a command.
Plan the VPS before installing
Choose the operating system and network identity
Use a current supported Debian installation. The documented dependency list covers Debian 11, 12 and 13, but one package name changes on Debian 13. Give the VPS a public IPv4 address, and decide on a fully qualified hostname such as irc.example.net. Create its DNS A record after you know the address; you can still test the service by IP before DNS is working.
Keep SSH restricted to your administration addresses or VPN where possible. Use both Debian’s host firewall and the VPS provider’s network firewall. A rule in only one of those layers is not sufficient if the other layer blocks the connection.
Decide which client ports to expose
| Port | Purpose | Recommendation |
|---|---|---|
| TCP 6697 | IRC over SSL/TLS | Expose this for normal clients. They must explicitly select SSL/TLS. |
| TCP 6667 | Plain IRC | Optional during migration; close it for a TLS-only network. |
Starting with UnrealIRCd 6.2.0, the project encourages administrators to close plaintext 6667 and use TLS on all client ports. A TLS-only policy reduces credential and message exposure on untrusted networks, but every client must support and be configured for TLS.
Prepare Debian and create a service account
Log in over SSH as a sudo-capable administrator. Patch the machine before building:
sudo apt-get update
sudo apt-get full-upgradeCreate an account that does not have sudo privileges. The exact home-directory and shell options can follow your normal Debian policy; the important point is that the build and daemon do not run as root.
sudo adduser --disabled-password --gecos "" unrealircdInstall the compiler and libraries required by the official UnrealIRCd build instructions. On Debian 11 and 12, the Argon2 development package is named libargon2-0-dev; Debian 13 uses libargon2-dev.
# Debian 11 or Debian 12
sudo apt-get install build-essential pkg-config libssl-dev libpcre2-dev
libargon2-0-dev libsodium-dev libc-ares-dev libcurl4-openssl-dev
# Debian 13
sudo apt-get install build-essential pkg-config libssl-dev libpcre2-dev
libargon2-dev libsodium-dev libc-ares-dev libcurl4-openssl-devIf apt-get cannot find a package, confirm the Debian release with cat /etc/os-release and verify that the normal Debian repositories are enabled. Do not work around a missing development library by running the compiler as root.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Download and compile UnrealIRCd 6
Obtain a release archive
Switch to the dedicated account and download the current UnrealIRCd 6 release archive from the project’s official download location. Use the filename and checksum published for that release; do not assume that an old example version remains current.
sudo -iu unrealircd
cd ~
# Download the current UnrealIRCd 6 archive using the official release page.
# The filename below is illustrative; use the exact current filename.
tar -xf unrealircd-6.x.y.tar.gz
cd unrealircd-6.x.yKeep the extracted source directory until you have confirmed that the installed daemon works. It contains the supplied startup unit under extras/startup, which you will use later.
Run the build
The documented starting point is to accept the defaults from Config, then compile and install:
./Config
make
make installRead the questions printed by ./Config rather than blindly changing paths. A normal per-user installation places the runnable tree in ~/unrealircd. After installation, work from that directory:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutecd ~/unrealircd
lsRun the daemon, configuration tests and administrative commands as the unrealircd account. Use root only for package installation, firewall changes and installing the systemd unit.
Configure the server from the shipped example
Set the server and network names
Use the example configuration shipped with the installation as your template. Edit ~/unrealircd/unrealircd.conf and set a fully qualified server name whose DNS A record will point to this VPS. Set a separate, human-readable network name for clients. The server name should be stable; changing it later affects certificates, client bookmarks and linked services.
Keep the configuration readable and make a backup before substantial edits:
cd ~/unrealircd
cp -a unrealircd.conf unrealircd.conf.before-customizationCreate an operator credential safely
Do not put a plaintext operator password in the configuration. Generate a hash with the installed command:
./unrealircd mkpasswdCopy the resulting hash into the appropriate operator block in unrealircd.conf. Restrict the file so only the service account and administrators can read it, especially if it contains email addresses, certificate paths or other private settings.
Define client authentication and policy
Review the example client authentication blocks rather than exposing an unrestricted open relay for unknown clients. Decide whether clients authenticate with passwords, certificates or another policy supported by your chosen configuration. Set operator privileges in an explicit oper block and grant only the capabilities required for administration.
Configure the MOTD and rules
Set the paths used for the message of the day and any rules file. The MOTD is where clients see connection guidance, support information and your TLS requirement. If the example refers to files that do not exist, create them with the expected names or change the paths. A missing file can prevent a clean startup depending on the block that references it.
Add listen blocks
A public TLS listener commonly resembles this form:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
listen {
ip *;
port 6697;
options {
ssl;
}
}The exact surrounding syntax should match the shipped example for your UnrealIRCd release. If you deliberately retain plaintext during migration, add a separate listener on 6667 and communicate clearly which endpoint clients should use. For a TLS-only network, omit the plaintext listener and close the corresponding firewall rule.
Install a trusted TLS certificate
Use a certificate issued by a trusted certificate authority, such as a current Let’s Encrypt certificate, with a name covering the hostname clients enter. A self-signed certificate may trigger warnings or outright rejection in IRC clients. The certificate and private-key paths in the TLS configuration must be readable by the unrealircd account while the private key remains inaccessible to ordinary users.
When a certificate is renewed, keep the path stable where possible. If the path or key changes, run a configuration test before reloading. Clients must select SSL/TLS and connect to the 6697 endpoint; merely typing 6697 into a plaintext connection field will fail.
For a migration that retains 6667, test both listeners independently. Once clients have moved to 6697, remove the plaintext listener and its firewall rule instead of leaving an unused clear-text entry exposed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Validate configuration before starting
From the installed directory, run the built-in test:
cd ~/unrealircd
./unrealircd configtestThis checks the configuration without starting the daemon. Fix every syntax error and any warning that prevents startup, then run the command again. Always repeat it after editing unrealircd.conf, changing certificate paths, upgrading UnrealIRCd or altering listen blocks. Starting first and discovering a typo from a failed service makes recovery harder, particularly when systemd is configured to restart the process.
Open the firewalls and test connectivity
Debian host firewall
Permit SSH from your administration source, then permit only the IRC ports you actually configured. The exact commands depend on whether you use nftables, ufw or another firewall manager; apply the rules through the tool already managing the host rather than running competing firewall systems.
At minimum, the effective rules must allow inbound TCP 6697. Add TCP 6667 only if the plaintext listener is intentionally enabled. Do not open arbitrary ranges “for IRC”; server-to-server linking, if you add it later, should use a separately planned and restricted port.
VPS provider firewall
Repeat the same allow rules in the provider’s security-group or network-firewall interface. If the host firewall allows a port but the provider firewall drops it, local tests can succeed while every remote client times out.
Test by IP, then by hostname
After starting a test instance, connect an IRC client to the VPS public IP and the selected port. Testing by IP isolates daemon and firewall problems from DNS problems. Once IP access works, create or correct the DNS A record for the server hostname and connect using that name so certificate validation can be tested as clients will experience it.
If a socket utility is available, use it from the VPS to confirm that the daemon is listening on the expected address and port. A listening socket proves only that the local process bound successfully; it does not prove that provider or host firewall rules permit remote traffic.
Recommended Free Tools
Run UnrealIRCd with systemd
Install the supplied unit
The source tree contains a service template in extras/startup. As an administrator, inspect and edit the unit so User=, Group= and ExecStart= point to the account and installed path you actually used.
cd /path/to/unrealircd-6.x.y/extras/startup
sudo editor unrealircd.service
sudo cp -av unrealircd.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable unrealircd.service
sudo systemctl start unrealircd.service/path/to/unrealircd-6.x.y is the source directory containing your extracted release; substitute its real path when running the command. The unit should not run as root, and its executable path must match the installed tree, normally /home/unrealircd/unrealircd/unrealircd.
Check status and logs
sudo systemctl status unrealircd
sudo journalctl -u unrealircd --since "10 minutes ago"If the unit exits immediately, run ./unrealircd configtest as the service account and inspect the journal for a wrong path, unreadable certificate, missing MOTD file or permission error. Correct the cause, reload systemd if the unit changed, and start it again.
Use one process manager
Once systemd owns the daemon, use these controls:
sudo systemctl start unrealircd
sudo systemctl stop unrealircd
sudo systemctl restart unrealircd
sudo systemctl status unrealircdDo not also launch a second copy manually from a shell or cron job. Competing launchers can produce port conflicts, confusing PID files and duplicate logs. Cron is a possible portable alternative, but systemd provides integrated boot ordering and service diagnostics on Debian.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Apply configuration changes without a full restart
After changing the configuration, MOTD or rules files, validate first and then rehash:
cd ~/unrealircd
./unrealircd configtest
./unrealircd rehashAn IRC operator can also issue the IRC REHASH command if that privilege is configured. Rehash loads accepted changes into the running process; it does not repair syntax errors, replace a crashed process or guarantee that every setting can change live. Read the daemon notices and logs after rehash and perform a controlled systemd restart when a setting requires process initialization.
Add NickServ and ChanServ only when needed
UnrealIRCd does not include NickServ or ChanServ. A small private network can run without services, using operator-managed channels and temporary nicknames. Add a services package when users need registered nicknames, registered channels, persistent topics, account passwords or account-based access controls.
A documented compatible choice is Anope, installed separately from the IRCd. Integration requires more than starting a second process:
- Define an UnrealIRCd
Linkblock for the services server, with the address, port and shared credentials required by both sides. - Add
ULinesfor the services server so its service clients receive the expected exemptions and privileges. - Set
set::services-serverto the services server name used by Anope. - Make the server names, link password, ports and protocol settings identical on both ends.
- Run
configteston UnrealIRCd and the equivalent configuration check on Anope before starting either service.
Keep the services link on a restricted interface or firewall rule where practical. If services fail to connect, check link names and credentials first, then verify that the selected server-to-server port is reachable; a NickServ error in a client usually means the services process is not linked, not that the IRC client is misconfigured.
Deployment choices and their trade-offs
| Decision | Option A | Option B | What changes for you |
|---|---|---|---|
| Installation | Compile the supported source release | Use a prebuilt distribution package | Source gives the current supported series and documented build options; a package can be easier to update but may lag the project. |
| Client transport | TLS-only on 6697 | 6697 plus plaintext 6667 | TLS-only protects traffic and credentials; retaining 6667 helps legacy clients during migration but exposes clear text. |
| Startup | systemd | Cron or a custom launcher | systemd integrates boot startup, status and logs on Debian; cron can be portable but requires you to build equivalent monitoring and restart behavior. |
| Account services | No services | A linked services package | No services means a smaller footprint; services add NickServ, ChanServ and persistent account/channel management but require a second configuration and process. |
No current official performance benchmark, capacity figure or total-cost comparison establishes how many users a particular VPS can support. Capacity depends on channel activity, clients, logging, services, TLS workload and the VPS resources, so size the machine from observed load rather than an unsupported user number.
Troubleshoot the common failures
There is no listener
- Run
sudo systemctl status unrealircdand inspect the journal. - As the service account, run
./unrealircd statusand./unrealircd configtest. - Check that each listen block uses valid syntax and that no other process already owns the port.
- Confirm that the systemd
ExecStart=path points to the installed binary, not the removed source directory.
Clients reject TLS
- Verify that the client is explicitly using SSL/TLS and port 6697.
- Check that the certificate covers the hostname the client enters, and that the key and certificate paths are readable by
unrealircd. - Replace a self-signed certificate with a trusted certificate if clients report an unknown issuer.
- Run
configtestafter every certificate-path or permission change, then rehash or restart as appropriate.
It works locally but not remotely
Test the public IP from a different network, then inspect both firewall layers. A local connection can succeed even when Debian’s firewall or the provider security group blocks all Internet traffic. Confirm that the rule is TCP, not UDP, and that it covers the exact configured port.
The hostname fails but the IP works
Correct the DNS A record so it points to the VPS public IPv4 address. Allow time for the record’s TTL to expire in recursive resolvers, and keep using the IP for daemon testing while DNS propagates. Once the record resolves, test TLS by hostname because certificate validation depends on that name.
Edits appear to be ignored
Run ./unrealircd configtest, then ./unrealircd rehash. Read the notices and logs for a rejected block, misspelled path or file permission problem. Remember that an IRC client may cache MOTD text or connection settings; verify the server-side log before assuming rehash failed.
NickServ or ChanServ is unknown
Those commands are not part of the UnrealIRCd core. Install and configure a compatible services package, establish its Link and ULines settings, set set::services-server, and verify that the services process is actually linked.
Operational checklist
- Keep Debian patched and retain the release archive and configuration backup used for the installation.
- Run the daemon as the dedicated
unrealircdaccount, never as root. - Use a trusted certificate and protect its private key and operator hashes.
- Expose only TCP 6697, plus TCP 6667 only while you intentionally support plaintext clients.
- Apply matching rules in the Debian firewall and the VPS provider firewall.
- Use the hostname covered by the certificate and maintain its DNS A record.
- Run
configtestbefore every restart or rehash. - Use systemd for process control and inspect its journal after failures.
- Back up
unrealircd.conf, MOTD, rules, certificates and services configuration before upgrades. - After an upgrade, repeat configuration testing and verify the TLS listener and linked services before reopening the network to users.
Bottom line
For a new Debian VPS, compile UnrealIRCd 6 under a dedicated account, configure a trusted TLS listener on 6697, validate with ./unrealircd configtest, open only the required firewall ports, and let systemd manage startup. Add Anope only when registered accounts and channels justify the extra process. This sequence gives you a maintainable IRC server without running the daemon as root or exposing plaintext by default.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
