This is explained in the FAQ. Red hosts are either firewalled or NAT-routed without port-forwarding.

This means that you can't connect directly to them; you can however download from them as Limewire sill send back a "PUSH" request along the same path from which the Query Result was received.

If that host has not disconnected from that path through which it sent its result, then it should receive the PUSH message, and then will connect itself to the downloader (you) using a "GIV" connection. Then your servent will be able to send its download request to the firewalled servent, now connected with you.

LimeWire has increased a lot the reliability of PUSH:
- first, it uses a "High-Degree/Low-TTL" topology that allows reducing the routing path between querying downloaders and replying uoloaders.
- second, PUSH messages can now traverse the cloud and get directly to the UltraPeer where the firewalled leaf node is currently connected.

A host is detected as "firewalled" (shown in red), if its IP address (indicated in its QueryHits) is local only (unreachable via Internet) for example 10.*.*.*, 172.16.*.* to 172.31.*.*, 192.168.*.* or other non routable IP addresses. Or if the replying host indicates this status in its QueryHits.

A few hosts are also firewalled but not detected like this. They are shown in black, but any attempt to connect directly to them may not give a reply or may timeout. In that case LimeWire will retry by sending a routed PUSH back to that servent.

Note that firewalled servents cannot download directly from other firewalled servents with this method.

However LimeWire implements now "Push Proxies", where an intermediate non-firewalled servent acts to relay the push and the transfer. Currently, push proxies are supported by UltraPeers, but this may change in the future to also allow non-firewalled leaf nodes acting as push proxies.

__________________
LimeWire is international. Help translate LimeWire to your own language.
Visit: http://www.limewire.org/translate.shtml