I2P Eepsite Hosting Guide - Running Hidden Services on the I2P Network

I2P uses unidirectional tunnels rather than Tor's bidirectional circuits. Each I2P node maintains separate inbound and outbound tunnels. An eepsite receives connections through its inbound tunnels and sends responses through separate outbound tunnels. This bidirectional separation provides additional anonymity at the cost of higher tunnel management overhead.

I2P addresses use a cryptographic destination identifier similar in concept to Tor's onion address but with a different format. The destination is a base64-encoded public key pair. Users reach eepsites through the I2P network by looking up the destination in a distributed network database or through a locally maintained address book that maps human-readable .i2p hostnames to destinations.

Unlike Tor where setting up a hidden service requires minimal configuration, I2P requires a functioning I2P router with sufficient network integration to maintain tunnel paths. The router needs to participate in routing other users' traffic as part of normal I2P participation. This active network participation requirement is conceptually different from Tor, where running a hidden service does not require operating a relay.

Install I2P from the official repository. The Java-based I2P router is the standard implementation:

wget -O - https://geti2p.net/_static/debian/i2pgpg.key | apt-key add -
echo "deb https://deb.i2p.net/ bookworm main" > /etc/apt/sources.list.d/i2p.list
apt update && apt install i2p i2p-keyring

Start I2P: systemctl start i2p. The I2P router web console is available at http://127.0.0.1:7657. Allow 15 to 30 minutes for the router to integrate with the I2P network. During this integration period, tunnel build success rates improve as the router discovers peers and establishes routing relationships. Do not configure your eepsite until the router shows good integration statistics in the console.

Monitor integration in the router console sidebar: the number of active tunnels and the network status indicator. A well-integrated router shows 10+ active tunnels and "OK" network status. "Rejecting tunnels" status indicates the router is still integrating or has limited resources. An eepsite hosted on a poorly integrated router will be slow and unreliable for visitors.

I2P includes a built-in web server (Jetty) for basic eepsites accessible at http://127.0.0.1:7658. For more control and performance, configure an external web server. Add a HTTP server tunnel in the I2P console at http://127.0.0.1:7657/i2ptunnelmgr. Select "New server tunnel", configure the target as your web server listening address (e.g., 127.0.0.1:8080), and start the tunnel.

After starting the tunnel, the I2P console shows a b32 address (a hash of the destination, ending in .b32.i2p) and a destination string. The b32 address is the permanent machine-readable address for your eepsite. Share this with users who can enter it directly. For human-readable addressing, register an address in the jump/subscriptionable addressbook using services like http://stats.i2p (accessible within I2P) - this maps a human-readable hostname.i2p to your destination.

The web server configuration for I2P eepsites is identical to Tor hidden service configuration: bind to 127.0.0.1 only, disable all clearnet resources, and block outbound clearnet traffic from the web server process. The same iptables rules that protect Tor hidden services apply equally to I2P eepsites.

I2P does not have a single authoritative DNS equivalent. Address resolution uses a distributed address book system where users subscribe to one or more addressbook services that map human-readable names to destinations. Registering your eepsite's human-readable name involves submitting to addressbook services that other I2P users subscribe to.

The primary address book registration services within I2P are stats.i2p and zzz.i2p (the I2P developer). Access these from within I2P and follow their submission procedures, which typically require providing your b32 address and desired hostname, optionally with proof of ownership. Registration is not instant and may take days to appear in subscribed address books.

For services that need immediate discoverability, share the b32 address directly with your intended audience. The b32 address is permanent and does not require address book registration to function. Human-readable hostnames are a convenience layer on top of the permanent b32 identifier, not a technical requirement.