VPS for I2P Network Node Hosting

Tor and I2P are both anonymity networks but with fundamentally different architectures. Tor uses a three-hop circuit model with centralized directory servers, optimized for accessing the clearnet anonymously. I2P uses a garlic routing model (multiple messages bundled together) with a distributed NetDB for peer discovery, optimized for internal network services (eepsites) and peer-to-peer applications.

I2P has no equivalent of Tor's exit nodes - the network is designed to be self-contained. You access I2P services (.i2p addresses) from within the I2P network. This makes I2P more resistant to exit node monitoring (a known Tor weakness) and better suited for hosting services that should only be accessible to other I2P users. Tor is better for anonymously browsing the clearnet; I2P is better for hosting services within an anonymity network.

A VPS-hosted I2P router that runs 24/7 with a static IP earns a higher network integration rating (more router info records published to the NetDB) and provides more stable routing for the network than a desktop router that comes online intermittently. Contributing a well-connected node from an offshore VPS is a meaningful contribution to network health.

I2P has two major implementations: the original Java-based I2P router and the newer Go-based i2pd (I2P daemon). i2pd is recommended for VPS use - it is more resource-efficient and runs as a daemon without requiring a JVM. Install from the official repository: add the i2pd apt repo (wget -q -O - https://repo.i2pd.xyz/.help/add_repo.sh | bash), then apt install i2pd.

Configure /etc/i2pd/i2pd.conf: set bandwidth = O (unlimited) if your VPS plan has unmetered bandwidth, or set a cap like bandwidth = 512 (KB/s) if you have a monthly transfer limit. Enable the webconsole at [http] enabled = true address = 127.0.0.1 port = 7070 for monitoring. Set [ntcp2] enabled = true port = 4567 published = true and open port 4567 (TCP and UDP) in your firewall for network reachability.

After starting i2pd (systemctl enable --now i2pd), access the webconsole through an SSH tunnel: ssh -L 7070:127.0.0.1:7070 user@your-vps-ip, then browse to localhost:7070. The console shows transit tunnels, network integration, known routers, and bandwidth usage. It takes 15-30 minutes for a new router to integrate into the network and begin routing transit traffic.

An eepsite is a website or service hosted within the I2P network, accessible only to I2P users. Hosting one on your VPS creates a permanently available service at a stable .i2p address. i2pd generates a unique cryptographic destination address for each service tunnel you configure. This address is your eepsite's identity on the network.

Configure an HTTP service tunnel in /etc/i2pd/tunnels.conf: set [myeepsite] with type = http, host = 127.0.0.1, port = 80 (or whatever port your web server listens on), keys = mysite.dat. The keys file stores your destination keypair - back it up, as it is your eepsite's permanent address. Start a web server on the configured port (nginx, apache, or a simple Python HTTP server for testing).

After i2pd restarts with the tunnel config, your eepsite gets a long Base32 address (like abc123...def.b32.i2p) visible in the webconsole under Tunnels. Publish this address to I2P address books (e.g., stats.i2p addressbook) so other users can find your site by a human-readable name. Your eepsite is accessible to anyone running an I2P router without exposing your VPS IP to visitors.

i2pd is lightweight: typically 50-150 MB RAM and 5-15% of a single CPU core when routing moderate transit traffic. Java I2P uses 256-512 MB RAM. On AnubizHost's Romania VPS Start ($17.90/mo, 1 vCPU, 1 GB RAM), i2pd runs alongside other services without resource pressure. Java I2P requires a dedicated 512 MB RAM allocation minimum.

Bandwidth is the primary cost consideration. An active I2P router configured with unlimited bandwidth can transit 5-50 GB per day depending on network demand. Check whether your VPS plan is unmetered or has a monthly transfer cap. AnubizHost's Romania VPS plans include generous transfer allowances - verify your specific plan's bandwidth allocation before setting I2P to unlimited mode. Configure a bandwidth cap in i2pd.conf if needed.

Security on an I2P router VPS follows standard hardening practices: SSH key-only authentication, ufw blocking all ports except SSH, NTCP2 (4567), and SSU2 (4567 UDP). The I2P router itself operates entirely within encrypted tunnels and does not expose your IP to eepsite visitors directly (they connect through I2P's routing layer). Run i2pd as a non-root user via the systemd service file for process isolation.