Bounced DCC connections unusable via firewalled ZNC host

PROCEDURE:

1. Configure ZNC to connect to a network without bouncing DCCs.
2. Confirm DCC transfers pass directly to the IRC client (e.g. XDCC bot transfer) - this works fine for me.
3. Configure DCCs to be bounced on this network.
4. Issue another XDCC command.
5. The client (mIRC in this case) reports that it is unable to connect:

===============================================================

[08:59:59] DCC Get of <file> from <XDCC bot> incomplete (unable to connect)
-
[09:00:27] DCC Get of <file> from <XDCC bot> incomplete (unable to connect)

===============================================================

and the ZNC user *status reports the following:

==========================================================================================================

[09:01:38] <*status> DCC Xfer Bounce (<XDCC bot>): Timeout waiting for incoming connection [<IP address of public interface>:57438]
[09:02:06] <*status> DCC Xfer Bounce (<XDCC bot>): Timeout waiting for incoming connection [<IP address of public interface>:57219]
[09:03:06] <*status> DCC Xfer Bounce (<XDCC bot>): Timeout waiting for incoming connection [<IP address of public interface>:40058]

==========================================================================================================

PROBLEM:

ZNC does not allow you to configure the following:

1. The network interface that ZNC opens its DCC server listening port on for your IRC client to connect to.
2. The listening port range used on the interface.

Because of this, a firewalled machine will block traffic to any listening ports ZNC opens, and you are unable to forward a specifc range to for ZNC to use to bypass the firewall.

I also need these two configuration options because I SSH tunnel my ZNC session and am therefore connecting from the localhost. For DCC bouncing to work for me, ZNC needs to open the DCC server listening port on the local host at a specified port range (which is the exit point of local SSH tunnels forwarded from my client machine).

WORKAROUND:

Do not bounce DCCs.