mIRC uses a special setting which allows it to connect through a firewall and
to make DCC connections work properly without the firewall knowing about it. If
this option is used together with iptables and specifically the ip_conntrack_irc
and ip_nat_irc modules, it will simply not work. The problem is that mIRC will
automatically NAT the inside of the packets for you, and when the packet reaches
the firewall, the firewall will simply not know how and what to do with it.
mIRC does not expect the firewall to be smart enough to take care of this by
itself by simply querying the IRC server for its IP address and sending DCC
requests with that address instead.
Turning on the "I am behind a firewall" configuration option and using the
ip_conntrack_irc and ip_nat_irc modules will result in Netfilter creating log
entries with the following content "Forged DCC send packet".
The simplest possible solution is to just uncheck that configuration option
in mIRC and let iptables do the work. This means, that you should tell mIRC
specifically that it is not behind a firewall.
