Invisible Internet Project (I2P)
- 1 Introduction
- 2 How-to: Use I2P in Whonix
- 3 Services
- 4 Installing I2P on Whonix-Gateway
- 5 Footnotes
I2P is an anonymous network built on top of the internet. It allows users to create and access content and build online communities on a network that is both distributed and dynamic. It is intended to protect communication and resist monitoring by third parties such as ISPs.
Aside from anonymizing traffic within the network, I2P functions with the same capabilities as the Internet, however its design and decentralization create a censorship resistant environment for the free-flow of information.
Mirrored sites hosted on the network allow access to news outlets and other resources in areas where information is being filtered or denied. Online communities wishing to organize in restrictive environments can do so anonymously to mitigate political threat and protect each other.
The I2P anonymous network exposes a simple layer that applications can use to anonymously and securely send messages to each other through "tunnels". The network itself is strictly message-based (IP), but there is a library available to allow reliable streaming communication on top of it (TCP). All communication is encrypted end-to-end -- in total there are four layers of encryption used when sending a message -- and even the end points ("destinations") are cryptographic identifiers (essentially a pair of public keys). 
This design is known as garlic routing [archive] which is a variant of onion routing [archive] (used in the Tor network) and benefits from the research on the latter but makes some different tradeoffs.  Each client application has their own I2P 'router' that finds other clients by querying against the fully distributed 'network database' - a custom structured distributed hash table (DHT) based on the Kademlia algorithm [archive]. Every router transports traffic for its peers which it uses as cover traffic for its own. To learn more about I2P technical details, see here [archive].
In contrast to the Tor network, I2P is focused on creating a community around P2P darknet services rather than providing "outproxies"(exits) to the clearnet. The I2P development team [archive] is an open group that welcomes all parties who are interested in getting involved [archive]. All the code is open source [archive]. The core I2P Software Development Kit (SDK) and the current router implementation is accomplished in Java,  and there is a simple socket based API [archive] for accessing the network from other languages (with a C library available, and both Python and Perl in development). The network is actively being developed and has not yet reached the 1.0 release, but the current roadmap [archive] describes their active schedule.
Tor vs I2P
Table: Tor vs. I2P Terminology 
|Tor Terminology||I2P Equivalent|
|Client||Router or Client|
|Directory Server||Floodfill Router|
|Entry Guards||Fast Peers|
|Hidden (Onion) Service||Hidden Service, Eepsite or Destination|
|Hidden Service Descriptor||LeaseSet|
|Hidden Service 'Stealth Mode'||I2P Client Whitelist  or Encrypted LeaseSets  |
|Introduction Point||Inbound Gateway|
|Onion Proxy||I2PTunnel Client (more or less)|
|Rendezvous Point||Similar to Inbound Gateway + Outbound Endpoint|
|Single Onion Service||I2P 0-hop Tunnel |
The I2P comparison page notes the relative strengths of Tor and I2P; those are summarized below.
Tor's primary strengths are: a larger user base; greater academic interest and research; significant funding; a large development team; greater resistance to state-level censorship (TLS transport and bridges); large number of exit nodes; better memory usage; thorough documentation; low client bandwidth overhead; higher throughput and lower latency. 
In comparison, I2P's primary strengths are: optimization for hidden services; a fully distributed design; better peer selection; varied and untrusted directory servers; peer-to-peer friendly nature; improved load balancing and resilience; unidirectional tunnels;  protection against client activity detection; short-lived tunnels;  low bandwidth overhead for full peers; TCP and UDP transports; and being based on the Java programming language. 
How-to: Use I2P in Whonix
There are two methods of using I2P in Whonix ™:
The inproxy method is better suited for causal use of I2P. In this instance, users just want to anonymously view an Eepsite and are not concerned about eavesdroppers so long as anonymity is assured.
It is safer to use the I2P client inside Whonix ™, since all I2P traffic is tunneled through Tor and access is fully featured. This is a little more difficult than installing I2P the ordinary way, that is using I2P in the clear, not over Tor.
Inproxies inside Whonix-Workstation
There are several I2P inproxies and they have similar functionality to Tor2web [archive].  Simply use Tor Browser which is installed in Whonix ™ by default to directly access the I2P proxies listed.
Although this is the easiest method, on the downside end-to-end encryption is lost when connecting to the eepsites. This is not the case when I2P is installed directly inside Whonix-Workstation ™ or if I2P is used in the ordinary way. Further, potentially Tor Exit Nodes can Eavesdrop on Communications if an inproxy uses plain http, since it is an unencrypted connection. This risk is averted if the inproxy uses https or is reachable via an onion service. In any case, the I2P inproxy administrator can see all of your traffic in the I2P network and it is impossible to prevent that.
Example list of I2P inproxy domains (in bold):
- http://forum.i2p.rocks [archive] 
- http://forum.i2p.re [archive]
- http://forum.i2p.xyz [archive]
- http://forum.i2p2piszzzndhfvr.onion [archive] 
- https://www.hiddenservice.net/ [archive]
- Many others are down at the time of writing; see footnotes. 
I2P Client inside Whonix-Workstation
The preferred configuration is to connect to Tor before I2P inside Whonix-Workstation ™:
Before configuring this tunnel link, it is recommended to read the following related wiki entries:
Post-Tor I2P Tunnel Effects
Table: Post-Tor I2P Connections
|Warning: No Stream-isolation Support||
Installation and Setup
Figure: I2P Router Console
- set your preferred language
- allow the network bandwidth test to complete (takes 60 seconds)
- review and adjust the bandwidth settings
- the default settings of 300 KB/s down / 60 KB/s up are fairly conservative
- users report settings of 5000+ KB/s provide better connectivity
- on the network configuration page, set "Prefer IPv4 over IPv6" and "Completely disable" the UDP port and save the changes
If errors appear like: "Network: ERR-UDP Disabled and Inbound TCP host/port not set" or "ERR-Clock Skew of X min", they can be safely ignored.
Note that once the Local Tunnels (shared clients) section shows a green connection, I2P should be fully functional and it is possible to browse eepsites like
echelon.i2p. Some users report this process can be lengthy and take more than 10 minutes before the tunnels are stable/available.
- The onion service search engine https://ahmia.fi [archive] now supports I2P eepsites and Tor2Web plans on adding I2P support. 
- http://seeker.i2p [archive] is a search engine for I2P eepsites.
- http://stats.i2p [archive] lists registered i2p websites.
- http://identiguy.i2p [archive] lists many known and alive I2P websites.
- http://no.i2p [archive] lists known latest and alive i2p websites. The site list is generated from registered sites and external sources.
- http://inr.i2p [archive] lists known latest and alive i2p websites. The site list is generated from registered sites and external sources.
Figure: I2P Browsing in Whonix ™
Many interesting features and functionality are implemented for I2P in the form of stand-alone packages or plugins that can be optionally installed from their official plugin eepsite [archive]. Various tools are available for:
- blogging, forums and wikis
- decentralized file storage
- development tools
- domain naming
- file sharing
- network administration
- real-time chat
- web browsing
- website hosting
The instructions are simple to follow. The signing keys for these plugins are already built into the official I2P package and so are already white-listed. This is not a complete list.
I2P-Bote [archive] is a serverless, encrypted email plugin that uses I2P for anonymity. Messages are stored in the distributed hash table (DHT) [archive] for 100 days, during which the recipient is able to download them. Emails are automatically encrypted and digitally signed, which means only the intended recipient can read them and they cannot be forged by third parties.
To back up I2P-Bote data, copy the i2pbote folder inside the I2P config directory (~/.i2p/i2pbote on Unix systems or /var/lib/i2p/i2p-config when running as a daemon).
Compartmentalize activities and only use the I2P-Bote/Susimail VM snapshot for this purpose. Generally, applications that run with a browser interface are vulnerable to a whole class of bugs, including cross-site request forgery (CSRF) [archive].
- themeable webmail interface
- user interface translated into many languages
- one-click creation of email accounts (called email identities)
- emails can be sent under a sender identity, or anonymously
- ElGamal, Elliptic Curve, and NTRU encryption
- encryption and signing is transparent, without the need to know about PGP
- delivery confirmation
- basic support for short recipient names
- IMAP / SMTP
- custom folders
- sending and receiving via relays, similar to Mixmaster
- lots of small improvements
RetroShare is a friend-to-friend [archive] (F2F) network that enables end-to-end encrypted communications, including general messaging, mail, forums, publish-subscribe messaging ('pubsub'), file exchange and even telephony. It can be used as an alternative to Syndie (see further below) and can be tunneled through I2P for enhanced anonymity.
To install RetroShare, see: Installation.
- cross-platform availability
- data is not stored on a central server, but only on your computer(s)
- all communication is secured with TLS and perfect forward secrecy [archive]
- every node is identified by a strong cryptographic certificate
- a completely open protocol -- open source, open development and open discourse
- portable and simple to use Web GUI
To install Syncthing, run.
sudo apt install syncthing
Syndie [archive] is I2P's distributed (decentralized) forum software, allowing asynchronous conversations between anonymous participants. It was the focus of I2P's creator shortly before he ceased public activity. It supports single and multiple author modes, adjustable visibility of posts and post moderation. Syndie features its own minimalist and secure reader to protect against browser exploitation. In 2018, Syndie was being rewritten in another programming language to provide a more modern and simple interface, along with basic image rendering. 
A key benefit of Syndie is that unlike centralized forums, it cannot be easily taken offline via denial of service attacks or administrative action, and there is no single point to monitor group activity. Offline forum participation is possible, by 'syncing up' any accumulated changes when it is convenient (days, weeks or even months later). In addition to simple text messages, entire webpages or the full content of sites can be packaged into a single post, which can even be browsed offline.
The Syndie Technical Features section notes: 
On the whole, Syndie works at the *content layer* - individual posts are contained in encrypted zip files, and participating in the forum means simply sharing these files. There are no dependencies upon how the files are transferred (over I2P [archive], Tor [archive], Freenet [archive], gnutella [archive], bittorrent [archive], RSS [archive], usenet [archive], email [archive]), but simple aggregation and distribution tools will be bundled with the standard Syndie release.
To install Syndie, run.
sudo apt install syndie
Unfortunately, I2P is not yet natively supported as a tunneling option in ZeroNet. However, progress has been made towards this goal since 2016; see footnotes to follow recent GitHub developments.  
Installing I2P on Whonix-Gateway
It is possible to run I2P and Tor simultaneously on Whonix-Gateway ™:
This configuration is untested by Whonix ™ developers and it is considered experimental. Also, Whonix ™ developer HulaHoop has noted it is difficult to have a preconfigured Tor Browser for accessing
.i2p domains and other non-clearnet top-level domains, as well as optimizing I2P operations when tunneled over Tor.
- https://geti2p.net/en/about/intro [archive]
- https://geti2p.net/en/research [archive]
- Currently working with both sun and kaffe; gcj support is planned for later.
- https://geti2p.net/en/comparison/tor [archive]
- https://twitter.com/i2p/status/756952247662239744 [archive]
- https://geti2p.net/sv/docs/how/network-database [archive]
- I2P documentation is lacking in describing these features, but there are plans to improve the situation.
- https://twitter.com/i2p/status/756948810790821888 [archive]
- This should make it more difficult for adversaries to compromise the relevant information.
- Making it harder for adversaries to sample for attack purposes.
- Tor2web is a project which allows Internet users access to Tor Onion Services without Tor Browser.
- http://i2p.rocks/ [archive]
- http://i2p2piszzzndhfvr.onion [archive] - simply append the onion service name after the short eepsite name, omitting the .i2p TLD as shown.
Non-functional I2P inproxy domains:
- awxcnx I2P eepsite inproxy
- awxcnx I2P IRC inproxy - see Chat for general chat safety advice.
- 6dyi4t72u7y6g763.onion [archive]
- Or simply add '.to' after '.i2p'. For example, instant of http://forum.I2P [archive] you could use http://forum.i2p.to [archive]
- This sounds worse than it really is because very few people are expected to use I2P over Tor. Further, I2P itself offers this option. It is not like a leeching mod.
- http://i2p2piszzzndhfvr.onion/doku.php/start [archive]
- https://www.reddit.com/r/i2p/comments/579idi/warning_i2p_is_linkablefingerprintable/ [archive]
- Privoxy homepage [archive]:
Privoxy is a non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk. Privoxy has a flexible configuration and can be customized to suit individual needs and tastes. It has application for both stand-alone systems and multi-user networks.
- Except in the case of YaCy, which needs internet access.
Optional: run I2P manually as
user. Note: The configuration folder changes to
- https://lists.torproject.org/pipermail/tor-talk/2016-January/039814.html [archive]
- https://chaoswebs.net/blog/2016/12/01/Exploiting-I2P-Bote/ [archive]
- https://chaoswebs.net/blog/2016/10/15/Stealing-Your-I2P-Email/ [archive]
Syncthing is a continuous file synchronization program. It synchronizes files between two or more computers and replaces proprietary sync and cloud services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it's transmitted over the internet.
- https://syncthing.net/ [archive]
- This guide is also reposted here [archive].
- https://i2pforum.net/viewtopic.php?f=25&t=9 [archive]
- https://syndie.de/features.html [archive]
- https://github.com/HelloZeroNet/ZeroNet/issues/57 [archive]
- https://github.com/HelloZeroNet/ZeroNet/issues/45 [archive]
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.
Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)