I2P how to

Welcome to I2P

Download

News

Announcements

Meetings

Roadmap

Task list

About I2P

FAQ

Forums (within I2P)

Bounties

Get involved

Donate!

I2P Team

Hall of Fame

Documentation

How does it work?

Tech intro

App Dev

Papers

Development

API

Licenses

Report a Bug

Syndie

Links

T-Shirt

Mirror

Mirror 2

Secure Site

Impressum

F A Q

I2P - FREQUENTLY ASKED QUESTIONS

Index

General

What systems will I2P run on?1.

Whats an "eepsite" and how do I configure my browser so I can use them?2.

My router has very few active peers, is this OK?3.

What do the Active x/y numbers mean in the router console?4.

My active peers / known peers / participating tunnels / connections /

bandwidth vary dramatically over time! Is anything wrong?

5.

Is using an outproxy safe?6.

Most of the eepsites within I2P are down?7.

What ports does I2P use?8.

Why is I2P listening for connections on port 32000?9.

I think I found a bug, where can I report it?10.

What happened to *.i2p.net? What happened to jrandom? Is I2P dead?11.

I have a question!12.

Setup

My router has been up for several minutes and has zero or very few

connections

13.

Why is I2P so slow?14.

I'm missing lots of hosts in my addressbook. What are some good

subscription links?

15.

How do I set up my own eepsite?16.

Bittorrent / I2PSnark / Azureus I2P Plugin Questions?17.

How do I connect to IRC within I2P?18.

I can't access regular Internet sites through I2P.19.

I can't access https:// or ftp:// sites through I2P.20.

FAQ - I2P http://www.i2p2.de/faq.html

1 of 12 11/14/2012 10:11 PM

Is it possible to use I2P as a SOCKS proxy?21.

How do I configure my browser?22.

How can I access the web console from my other machines or password

protect it?

23.

How can I use applications from my other machines?24.

How do I reseed manually?25.

My router is using too much CPU?!?26.

Misconception

How do I access IRC, BitTorrent, or other services on the regular Internet?27.

Is my router an "exit node"(outproxy) to the regular Internet? I don't want it to

be.

28.

I am opposed to certain types of content. How do I keep from distributing,

storing, or accessing them?

29.

Errors and Their Solutions

I'm using FreeBSD and when I start I2P I receive an error about libm.so.4!30.

In wrapper.log I see an error stating Protocol family unavailablewhen I2P is loading

31.

What systems will I2P run on? (link)

While I2P has been reported to run PCs as meagre as a low-end Pentium II with 64 MB

of RAM, you'll have a much better experience on a Pentium III (or better) with 128MB of

RAM (or more). A chart comparing the performance of the various JREs can be found

at http://trac.i2p2.de/wiki/java, but in short: it's at all possible, use Sun/Oracle Java or

OpenJDK.

I2P has been tested on Windows, Linux, FreeBSD (see the note below), OSX, and

OpenSolaris. There is work underway to bring I2P to the Android platform.

I think I found a bug, where can I report it? (link)

Here are some places, pick one or more.

trac.i2p2.de ticket (preferred method)

pastethis.i2p and follow up on IRC in #i2p

Discuss with the developers on IRC in #i2p-dev

Please include relevant information from the router logs and wrapper logs.

I'm missing lots of hosts in my addressbook. What are some good


2 of 12 11/14/2012 10:11 PM

subscription links? (link)

The default subscription is to http://www.i2p2.i2p/hosts.txt which is updated rarely. If

you don't have another subscription, you may often have to use "jump" links which is

annoying.

Here are some other public addressbook subscription links. You may wish to add one

or two to your susidns subscription list. You don't need to add all of them, as they sync

with each other periodically. The links using a cgi-bin application employ various

strategies to minimize the number of duplicate addresses delivered, so they should be

more efficient. Note that subscribing to a hosts.txt service is an act of "trust", as a

malicious subscription could give you incorrect addresses. So think about whether you

want to trust any of these. The operators of these services may have various policies

for listing hosts. Presence on this list does not imply endorsement.

http://i2host.i2p/cgi-bin/i2hostetag

http://stats.i2p/cgi-bin/newhosts.txt

What happened to *.i2p.net? What happened to jrandom? Is I2P dead? (link)

Jrandom was the lead developer of I2P and Syndie for several years. We do not know if

or when jrandom will return. The *.i2p.net domains were left in a non-functioning state

after a power outage at the hosting company.

See this page for jrandom's parting message and additional information on the

migration of *.i2p.net to this website.

I2P remains in active development.

My router is using too much CPU?!? (link)

There are many possible causes of high CPU usage. Here is a checklist:

Try to use either OpenJDK or Sun/Oracle Java if it's available for your

system. You can check which version of java you have installed by typing

java -version at a command/shell prompt. Performance tends to

suffer with other implementations of java.

Are you running a BitTorrent client over I2P? Try reducing the number of

torrents, the bandwidth limits, or try turning it off completely to see if that

helps.

Are your bandwidth limits set too high? It is possible that too much traffic

is going through your I2P router and it is overloaded. Try reducing the

setting for share bandwidth percentage on the configuration page.

Make sure that you're running the latest version of I2P to get the benefits

of increased performance and bug fixes.

Has enough memory been set aside for use by I2P? Look at the memory

graph on the graphs page to see if the memory usage is "pegged"—the

JVM is spending most of its time in garbage collection. Increase the

setting wrapper.java.maxmemory in wrapper.config.

Is the CPU usage simply higher than you would like, or is it pegged at

100% for a long time? If it's pegged, this could be a bug. Look in the logs

for clues.

You may be using the Java-based BigInteger library instead of the native


3 of 12 11/14/2012 10:11 PM

version, especially if you are running on a new or unusual OS or hardware

(OpenSolaris, mipsel, etc.). See the jbigi page for instructions on

diagnosing, building, and testing methods.

If your native jbigi library is working fine, the biggest user of CPU may be

routing traffic for participating tunnels. This uses CPU because at each

hop a layer of encryption must be decoded. You can limit participating

traffic in two ways - by reducing the share bandwidth on confignet.jsp, or

by setting router.maxParticipatingTunnels=nnn on

configadvanced.jsp.

I am opposed to certain types of content. How do I keep from distributing,

storing, or accessing them? (link)

Hmm. I2P is an anonymous network, so that's a tricky one. I2P is designed to withstand

censorship, providing a means for everyone to communicate freely. The best way to

keep your PC free of (encrypted) traffic that you dislike is to not use I2P. Freedom of

speech has some costs. But let's address your question in three parts:

Distribution - All traffic on I2P is encrypted in multiple layers. You don't

know a message's contents, source, or destination. All traffic you route is

internal to the I2P network, you are not an exit node (outproxy). Your only

alternative is to refuse to route any traffic, by setting your share bandwidth

or maximum participating tunnels to 0 (see above). It would be nice if you

didn't do this, you should help the network by routing traffic for others.

Over 95% of users route traffic for others.

Storage - I2P does not do distributed storage of content. You must be

thinking of Freenet. Nobody's content is being stored on your computer by

running I2P.

Access - If there are some eepsites you don't like, don't go there. Or, use

a blocking proxy like Privoxy or some type of "net nanny".

My active peers / known peers / participating tunnels / connections /

bandwidth vary dramatically over time! Is anything wrong? (link)

No. This is normal. All routers adjust dynamically to changing network conditions and

demands.

My router has been up for several minutes and has zero or very few

connections (link)

You may need to reseed your I2P router. With recent versions of I2P you can go to

http://localhost:7657/configreseed and click the Save Changes and Reseed Now

button. If this method doesn't work—or you're using a very old version—you may need

to reseed manually.

The reseed URL changed a few years ago. If this is your first install and you have

installed an old (0.6.1.30 or earlier) release, or you have not run I2P in a long time, you

must change the URL and then click "Reseed" on the console to find other routers.

After your router is running, on configadvanced.jsp, add the line

i2p.reseedURL=http://netdb.i2p2.de/ OR

i2p.reseedURL=http://i2pdb.tin0.de/netDb/ (either should work), then click

"Apply", then click the "reseed" link on the left.


4 of 12 11/14/2012 10:11 PM

This works if you are running 0.6.1.27 or later. If you are running release 0.6.1.31 or

later, you probably don't need to do this. If you are running release 0.6.1.26 or earlier,

either follow the manual reseed instructions below or install the latest release. Possible

alternate method - add

wrapper.java.additional.5=-Di2p.reseedURL=http://netdb.i2p2.de/to wrapper.config, shutdown the router completely, then start again, then click "reseed".

Let us know if this works.

...but you *really* should upgrade to the latest version.

My router has very few active peers, is this OK? (link)

If your router has 10 or more active peers, everything is fine. Changes in releases

0.6.1.31 and 0.6.1.32 improved the efficiency of the router and effectively reduced the

number of active peers. The router should maintain connections to a few peers at all

times. The best way to stay "better-connected" to the network is to share more

bandwidth.

Is my router an "exit node" to the regular Internet? I don't want it to be.

(link)

No. Unlike Tor, "exit nodes" or "outproxies" are not an inherent part of the network. Only

volunteers who set up and run separate applications will relay traffic to the regular

Internet. There are very, very few of these.

I can't access regular Internet sites through I2P. (link)

See above. There are very few HTTP "outproxies", they are not an inherent part of the

network, and they may not be up. In addition, the old outproxies squid.i2p, true.i2p, and

krabs.i2p have vanished. The only outproxy at the moment is false.i2p. To use it, edit

your i2ptunnel settings for eepProxy and set your outproxy list to 'false.i2p' (only). Then

stop and restart the eepProxy. If it doesn't work, the outproxy is not up. It is not I2P's

fault. If your primary reason to use an anonymous network is to anonymously access

sites on the regular Internet, you should probably try Tor.

I can't access https:// or ftp:// sites through I2P. (link)

Within I2P, there is no need for HTTPS, as all traffic is encrypted end-to-end. FTP is not

supported for technical reasons.

There are no FTP "outproxies" to the Internet—it may not even be possible to set up

one. Any other kind of outproxy may work if it's set up with a standard tunnel. If you

would like to set up some type of outproxy, carefully research the potential risks. The

I2P community may or may not be able to help with the technical aspects, feel free to

ask.

As explained several times above, any existing outproxy isn't a core part of the network.

They are services run by individuals and they may or may not be operational at any

given time.

Update: Thanks to the work of h2ik, there is an https outproxy available for use via I2P.

Starting with I2P 0.8.4 the tunnel is configured out of the box.

In case the https outproxy is not available in your version of I2P, you can add it easily

by doing the following:

Open i2p tunnel manager. Scroll down to the bottom.1.


5 of 12 11/14/2012 10:11 PM

Choose CONNECT from New Client Tunnel dropdown list, click Create2.

In the new page, name and describe your new https tunnel as you like. The

Access Point is your local port for the new https proxy recommended port's

4445. Outproxy should be the outproxy's .i2p address which supports https.

See this forum post of h2ik's for the address. Make sure Shared Client,

Delay Connect, AutoStart are checked. Other options should be left at the

defaults. Click Save. In tunnel manger, click the Start button next to your new

tunnel.

3.

In firefox, click through Tools>Options>Advanced>Network>Setting.

Untick Use this proxy for all protocol, set SSL proxy: to localhost:4445.

4.

Done.5.

Is using an outproxy safe? (link)

This is a question that only you can answer because the correct answer depends on

your behaviours, your threat model, and how much you trust the outproxy operator.

Like Tor, I2P does not magically encrypt the Internet. You are vulnerable to snooping

by the outproxy operators. The Tor FAQ does a good job of explaining this.

In addition, you may be vulnerable to collusion between the outproxy operator and

operators of other I2P services, if you use the same tunnels ("shared clients"). There is

additional discussion about this on zzz.i2p.

How do I access IRC, BitTorrent, or other services on the regular Internet?

(link)

Unless an outproxy has been set up for the service you want to connect to, this cannot

be done. There are only three types of outproxies running right now: HTTP, HTTPS,

and email. Note that there is not a SOCKS outproxy. If this type of service is required,

try Tor.

Most of the eepsites within I2P are down? (link)

If you consider every eepsite that has ever been created, yes, most of them are down.

People and eepsites come and go. A good way to get started in I2P is check out a list

of eepsites that are currently up. perv.i2p tracks active eepsites.

How do I set up my own eepsite? (link)

Click on the Website link at the top of your router console for instructions.

Why is I2P so slow? (link)

Why are downloads, torrents, web browsing, and everything else so slow on I2P? The

encryption and routing within the I2P network adds a substantial amount of overhead

and limits bandwidth. Anonymity isn't free.

In addition, you and everybody else probably need to increase your bandwidth limits.

Two key settings are the inbound and outbound bandwidth limiters on the configuration

page. With the default settings of 32KBps you will generally get no better than 15KBps

data transfer in I2PSnark. Increasing the settings (but keeping within your actual

connection limitations) will increase the potential transfer rate for I2PSnark and all other

applications.


6 of 12 11/14/2012 10:11 PM

Also, do you have sufficient share bandwidth configured to allow participating tunnels to

route through your router? Believe it or not, allowing participating traffic keeps you

well-integrated in the network and helps your own transfer speeds.

I2P is a work in progress. Lots of improvements and fixes are being implemented, and

generally speaking, running the latest release will help your performance. If you haven't,

install the latest release.

Bittorrent / I2PSnark / Azureus I2P Plugin Questions? (link)

See the I2P Bittorrent FAQ (outside I2P)

How do I connect to IRC within I2P? (link)

On the I2PTunnel configuration page, start the ircProxy. Then tell your IRC client to

connect to localhost port 6668.

How can I access the web console from my other machines or password

protect it? (link)

For security purposes, the router's admin console by default only listens for connections

on the local interface. However, with a little hacking, you can make it reachable

remotely:

Open ~/.i2p/clients.config and replace

clientApp.0.args=7657 ::1,127.0.0.1 ./webapps/with

clientApp.0.args=7657 0.0.0.0 ./webapps/

1.

Go to http://localhost:7657/configadvanced.jsp and add a new option:

consolePassword=foo (or whatever password you want)

2.

Go to http://localhost:7657/index.jsp and hit "Graceful restart", which restarts

the JVM and reloads the client applications

3.

After that fires up, you should now be able to reach your console remotely. You will be

prompted for a username and password though - the username is "admin" and the

password is whatever you specified in step 2 above. Note: the 0.0.0.0 above

specifies an interface, not a network or netmask. 0.0.0.0 means "bind to all interfaces",

so it can be reachable on 127.0.0.1:7657 as well as any LAN/WAN IP.

How can I use applications from my other machines? (link)

By default, the router I2CP interface (port 7654) binds to address 127.0.0.1. To bind to

0.0.0.0, set the router advanced configuration option

i2cp.tcp.bindAllInterfaces=true and restart.

Whats an "eepsite"? (link)

An eepsite is a website that is hosted anonymously - you can access it by setting your

web browser's HTTP proxy to use the web proxy (typically it listens on localhost port

4444), and browsing to the site.

How do I configure my browser? (link)

The proxy config for different browsers is on a separate page with screenshots. More


7 of 12 11/14/2012 10:11 PM

advanced configs with external tools are possible but could introduce leaks in your

setup.

What do the Active x/y numbers mean in the router console? (link)

x is the number of peers you've sent or received a message from successfully in the

last minute, y is the number of peers seen in the last hour or so.

Is it possible to use I2P as a SOCKS proxy? (link)

The SOCKS proxy is working as of release 0.7.1. SOCKS 4/4a/5 are supported. There

is no SOCKS outproxy so it is of limited use.

In addition, many applications leak sensitive information that could identify you on the

Internet. I2P only filters connection data, but if the program you intend to run sends this

information as content, I2P has no way to protect your anonymity. For example, some

mail applications will send the IP address of the machine they are running on to a mail

server. There is no way for I2P to filter this, thus using I2P to 'socksify' existing

applications is possible, but extremely dangerous.

If you would like more information on the socks proxy application anyway, there are

some helpful hints on the socks page.

What ports does I2P use? (link)

Okay, here's a rundown of the default ports (everything is configurable through various

settings, of course):

Internet-facing ports Note: New installs as of release 0.7.8 do not use

port 8887; they select a random port between 9000 and 31000 when the

program is run for the first time. The selected port is shown on the router

configuration page.

Outbound UDP from the random port noted on the

configuration page to arbitrary remote UDP ports,

allowing replies

Outbound TCP from random high ports to arbitrary

remote TCP ports

(optional, but recommended) Inbound UDP to the port

noted on configuration page from arbitrary locations

(optional, but recommended) Inbound TCP to the port

noted on configuration page from arbitrary locations

Inbound TCP may be disabled on the configuration page.

Outbound UDP on port 123, allowing replies

This is necessary for I2P's internal time sync (via SNTP -

querying a random SNTP host in pool.ntp.org or another

server you specify)

Local I2P ports, listening only to local connections by default, except

where noted:


8 of 12 11/14/2012 10:11 PM

1900: UPnP SSDP UDP multicast listener. Cannot be

changed. Binds to all interfaces. May be disabled on

confignet.jsp.

2827: BOB bridge, a higher level socket API for clients

Disabled by default. May be enabled/disabled on

configclients.jsp. May be changed in the bob.config file.

4444: HTTP proxy May be disabled or changed on the

i2ptunnel page in the router console. May also be configured

to be bound to a specific interface or all interfaces.

4445: HTTPS proxy May be disabled or changed on the



6668: IRC proxy May be disabled or changed on the



7652: UPnP HTTP TCP event listener. Binds to the LAN

address. May be changed with advanced config

i2np.upnp.HTTPPort=nnnn. May be disabled on

confignet.jsp.

7653: UPnP SSDP UDP search response listener. Binds to

all interfaces. May be changed with advanced config

i2np.upnp.SSDPPort=nnnn. May be disabled on

confignet.jsp.

7654: I2P Client Protocol port, used by client apps. May be

changed to a different port on configclients.jsp but this is not

recommended. May be to bind to a different interface or all

interfaces, or disabled, on configclients.jsp.

7655: UDP for SAM bridge, a higher level socket API for

clients Only opened when a SAM V3 client requests a UDP

session. May be enabled/disabled on configclients.jsp. May

be changed in the clients.config file with the SAM command

line option sam.udp.port=nnnn.

7656: SAM bridge, a higher level socket API for clients

Disabled by default for new installs as of release 0.6.5. May

be enabled/disabled on configclients.jsp. May be changed in

the clients.config file.

7657: Your router console May be disabled in the

clients.config file. May also be configured to be bound to a

specific interface or all interfaces in that file.

7658: Your eepsite May be disabled in the clients.config file.

May also be configured to be bound to a specific interface or

all interfaces in the jetty.xml file.

7659: Outgoing mail to smtp.postman.i2p May be disabled

or changed on the i2ptunnel page in the router console. May

also be configured to be bound to a specific interface or all

interfaces.

7660: Incoming mail from pop.postman.i2p May be disabled


9 of 12 11/14/2012 10:11 PM

or changed on the i2ptunnel page in the router console. May

also be configured to be bound to a specific interface or all

interfaces.

8998: mtn.i2p2.i2p (Monotone - disabled by default) May be

disabled or changed on the i2ptunnel page in the router

console. May also be configured to be bound to a specific

interface or all interfaces.

31000: Local connection to the wrapper control channel

port. Outbound to 32000 only, does not listen on this port.

Starts at 31000 and will increment until 31999 looking for a

free port. To change, see the wrapper documentation. For

more information see below.

32000: Local control channel for the service wrapper. To

change, see the wrapper documentation. For more

information see below.

The local I2P ports and the I2PTunnel ports do not need to be reachable from remote

machines, but *should* be reachable locally. You can also create additional ports for

I2PTunnel instances via http://localhost:7657/i2ptunnel/ (and in turn, would need to get

your firewall to allow you local access, but not remote access, unless desired).

So, to summarize, nothing needs to be reachable by unsolicited remote peers, but if

you can configure your NAT/firewall to allow inbound UDP and TCP the outbound

facing port, you'll get better performance. You will also need to be able to send

outbound UDP packets to arbitrary remote peers (blocking IPs randomly with

something like PeerGuardian only hurts you - don't do it).

Why is I2P listening on port 32000? (link)

The Tanuki java service wrapper that we use opens this port—bound to localhost—in

order to communicate with software running inside the JVM. When the JVM is launched

it is given a key so it can connect to the wrapper. After the JVM establishes its

connection to the wrapper, the wrapper refuses any additional connections.

More information can be found in the wrapper documentation.

How do I reseed manually? (link)

An I2P router only needs to be seeded once, to join the network for the first time.

Reseeding is nothing more than sending plain HTTP GET requests to fetch a directory

listing and download multiple "routerInfo" files from a predefined reseed URL.

A typical symptom of a failed reseed is the "Known" indicator (on the left sidebar of the

router console) displaying a very small value (often less than 5) which does not

increase. This can occur, among other things, if your firewall limits outbound traffic, and

blocked the reseed request.

To reseed an I2P router manually, do the following:

Stop your I2P router

Open http://netdb.i2p2.de/ using a web browser

Save a dozen "routerInfo" files to your I2P "netDb" directory


10 of 12 11/14/2012 10:11 PM

Start your I2P router

I'm using FreeBSD and when I start I2P I receive an error about

libm.so.4! (link)

When trying to start the router using "i2prouter start", you may see output like the

following:

$ ./i2prouter start Starting I2P Service... /libexec/ld-elf.so.1: Shared object "libm.so.4" not found,required by "i2psvc"

In order to be inclusive and try to ensure that I2P will run on as many systems as

possible, up until I2P 0.8.9 we used a java wrapper compiled for FreeBSD 6.x. If you're

receiving this error you most likely are missing the necessary compatibility libraries.

These libraries may be installed by performing the following steps:

Switch to the root user with su or log in as root.

cd /usr/ports/misc/compat6x

make install

If you cannot install these compatibility libraries (or do not want to), other possibilities

would be to compile the wrapper for your system, starting I2P with the runplain.shscript, or you can replace the wrapper with one from the source tarball.

For the 0.8.9 release of I2P, the wrapper was upgraded to v3.5.12 and compiled on

systems running FreeBSD 7.2.

In wrapper.log I see an error that states "Protocol familyunavailable" when loading the Router Console (link)

Often this error will occur with any network enabled java software on some systems that

are configured to use IPv6 by default. There are a few ways to solve this:

On Linux based systems, you can echo 0 > /proc/sys/net/ipv6/bindv6only

Look for the following lines in wrapper.config.

#wrapper.java.additional.5=-Djava.net.preferIPv4Stack=true#wrapper.java.additional.6=-Djava.net.preferIPv6Addresses=false

If the lines are there, uncomment them by removing the "#"s. If the lines

are not there, add them without the "#"s.

Another option would be to remove the ::1 from ~/.i2p/clients.config

WARNING: For any changes to wrapper.config to take effect, you must completely

stop the router and the wrapper. Clicking Restart on your router console will NOT

reread this file! You must click Shutdown, wait 11 minutes, then start I2P.

I have a question! (link)

Great! Find us on IRC irc.freenode.net #i2p or post to the forum (within I2P) and we'll


11 of 12 11/14/2012 10:11 PM

post it here (with the answer, hopefully).


12 of 12 11/14/2012 10:11 PM

Documents

I2P how to