How to Use I2P: A Practical Guide to the Invisible Internet

Install and configure the I2P router on Ubuntu, access eepsites, and understand how I2P differs from Tor.

What I2P Is

I2P — the Invisible Internet Project — is an anonymous overlay network. Unlike Tor, which is designed primarily for accessing the clearnet anonymously, I2P is built for communication within the network. Services hosted on I2P (called eepsites) are the primary use case.

Traffic in I2P travels through unidirectional tunnels. Your outbound traffic uses one set of routers; responses come back through a different set. Each tunnel is short-lived and rebuilt frequently. No single router in the path knows both the sender and the destination.

How I2P Differs from Tor

Tor is optimised for outproxying — reaching clearnet sites anonymously through exit nodes.
I2P is optimised for internal services — eepsites, messaging, file sharing within the network.
Tor uses a centralised directory of relays. I2P uses a distributed network database (netDb) with no central authority.
I2P uses packet-based rather than circuit-based routing, which makes it better suited to UDP traffic (torrenting, for instance, works natively on I2P).

Neither replaces the other. Use Tor for anonymous clearnet access. Use I2P for accessing or hosting services within the I2P network.

Installing I2P on Ubuntu

Using the PPA (Recommended)

sudo apt install apt-transport-https curl
curl -fsSL https://geti2p.net/_static/i2p-archive-keyring.gpg | sudo gpg --dearmor -o /usr/share/keyrings/i2p-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/i2p-archive-keyring.gpg] https://deb.i2p2.de/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/i2p.list
sudo apt update
sudo apt install i2p i2p-keyring

Starting I2P

Run I2P as a service:

sudo systemctl enable i2p
sudo systemctl start i2p

Or run it as your own user (preferred for desktop use):

i2prouter start

The router console opens at http://127.0.0.1:7657. Bookmark this — it is your control panel.

The Router Console

The router console at 127.0.0.1:7657 shows:

Network status — whether you are firewalled, your bandwidth usage, active tunnels and peers
Bandwidth configuration — set your share bandwidth (I2P is a peer network; you route other people's traffic)
Tunnel status — the state of your exploratory and client tunnels
Addressbook — your local DNS-like mapping of .i2p hostnames to destinations

On first start, give the router 10 to 15 minutes to integrate into the network. It needs to discover peers, build tunnels and populate the netDb. You will see the sidebar status change from Testing to OK or Firewalled.

Configuring Your Bandwidth

I2P works best when you share bandwidth. Navigate to Configuration > Bandwidth in the router console.

Set your share bandwidth to something reasonable — 256 KBps is a good starting point if your connection supports it. The more you share, the better your anonymity set because your router handles more transit traffic that is indistinguishable from your own.

# Typical settings for a home connection:
# Share bandwidth: 256 KBps (2 Mbps)
# Inbound/Outbound: 512 KBps each

Accessing Eepsites

Eepsites are websites hosted within the I2P network. They use .i2p domains. To access them, configure your browser to use the I2P HTTP proxy:

Browser Proxy Configuration

Set your browser HTTP proxy to:

HTTP Proxy:  127.0.0.1
Port:        4444
HTTPS Proxy: 127.0.0.1
Port:        4445

In Firefox, go to Settings > Network Settings > Manual Proxy Configuration and enter these values. Enable Proxy DNS when using SOCKS v5 if using the SOCKS proxy (port 4447) instead.

Important: Use a separate browser profile for I2P browsing. Do not use your everyday browser with these proxy settings — when the I2P router is stopped, requests will fail or leak to the clearnet.

Creating a Dedicated Firefox Profile

firefox -CreateProfile i2p
firefox -P i2p --no-remote

Configure the proxy settings in this profile only. This keeps your I2P browsing isolated.

Testing the Connection

Once the proxy is configured and the router has integrated, visit:

http://i2p-projekt.i2p — the I2P project homepage
http://stats.i2p — network statistics
http://identiguy.i2p — an I2P address directory

If pages load slowly on first access, this is normal. I2P builds tunnels on demand and caches routes over time. Performance improves after the router has been running for a while.

The Addressbook

I2P uses an addressbook system rather than DNS. Your local addressbook maps human-readable .i2p hostnames to Base64 destination keys. The router console manages this at Addressbook in the sidebar.

Default address subscriptions are configured in the router. You can add community-maintained subscription lists to discover more eepsites:

Navigate to Configuration > Addressbook and add subscription URLs. Subscriptions update periodically and add new hostname mappings automatically.

Hosting an Eepsite

I2P includes a built-in web server (Jetty) for hosting eepsites. Your site's content goes in:

~/.i2p/eepsite/docroot/

The default tunnel is already configured. Place your HTML files in that directory and your eepsite is accessible at the destination address shown in the router console under Hidden Service Manager.

To get a human-readable .i2p hostname, register your destination key with an address registrar such as stats.i2p.

Hardening Your Eepsite

If you are hosting a service, review these tunnel settings in the Hidden Service Manager:

Tunnel count — increase inbound and outbound tunnels from 2 to 3 for reliability
Tunnel length — the default of 3 hops is a reasonable balance of anonymity and speed
Tunnel backup count — set to 1 for redundancy

Remove the Jetty server header and any identifying information from your pages. Ensure file timestamps do not leak your timezone.

Firewalls and NAT

I2P works behind NAT but performs better with a forwarded port. The router console shows your network status:

OK — fully reachable; port forwarding is working or UPnP succeeded
Firewalled — the router works but cannot accept inbound connections; it relies entirely on other peers initiating contact

To forward the port manually:

# Check which port I2P is using:
grep "i2np.udp.port" ~/.i2p/router.config

Forward that UDP port on your router. Restart I2P after making the change.

I2P over Tor

You can route I2P's outbound connections through Tor for additional network-level anonymity (hiding I2P usage from your ISP). Configure the outbound proxy in the router console:

Navigate to Configuration > Network > Outproxy and set:

SOCKS proxy: 127.0.0.1:9050

This adds latency. Only do this if hiding I2P usage from your ISP is a specific requirement.

Operational Considerations

Uptime matters. I2P routers that stay online longer build better peer connections and faster tunnels. If you can run it on a server or always-on machine, do so.
Do not mix identities. Keep I2P browsing in a separate browser profile with no personal accounts.
Java dependency. I2P is a Java application. Keep your JRE updated: sudo apt update && sudo apt upgrade default-jre.
Clock accuracy. I2P requires accurate system time. Ensure NTP is running: sudo timedatectl set-ntp true.

Summary

I2P is a peer-to-peer anonymity network built for internal services. Install it from the official PPA, give the router time to integrate, configure a dedicated browser profile for the HTTP proxy, and share bandwidth to strengthen the network. It complements Tor rather than replacing it — use Tor for the clearnet, I2P for the invisible one.