sam/i2pforge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
Page: opsec mistakes
Pages
Home backing up your key encrypt at rest faq how it works operator runbook opsec mistakes running multiple tunnels the installer troubleshooting verifying your setup
1 opsec mistakes
Sam Bent edited this page 2026-07-17 15:15:52 -04:00
Table of Contents

OPSEC mistakes

i2pforge hides your server's IP address. It cannot hide mistakes you make elsewhere. If your threat model is serious, read this page carefully, because the most common way people get found is not a broken tool. It is a leak they built themselves.

Your backend can give you away

i2pforge forwards traffic to your backend. If your backend tells the visitor something that points back to the real you, that leaks straight through.

  • Absolute links and assets. If your site links to https://your-real- domain.com/style.css, the visitor's browser will try to fetch that from the clear internet, which reveals they are looking at your site and can reveal you. Serve everything with relative links, or use the mirror mode's full anti-leak rewriting.
  • Server headers. Banners like Server: or debug headers can fingerprint your exact software and version. Strip them at the backend.
  • Analytics and third-party scripts. Anything that calls out to Google, a CDN, or a tracker defeats the point. Remove them.
  • Email and contact details. A support address or a name in the page body is a direct link to your identity. Decide on purpose what you reveal.

Do not reuse an identity

If the same content, the same PGP key, the same writing style, or the same username appears on both your clear site and your .b32.i2p site, someone can tie them together. Treat the I2P service as a separate identity if separation is the goal.

The clock matters

I2P needs an accurate clock to build tunnels. The container uses the host's clock. If your host clock is badly wrong, the service will not work, and a very wrong clock can also make you stand out. Keep the host time synced.

Mirror mode has a lite option that leaks

If you use mirror mode to put an existing clear site onto I2P, use the full mode, not lite. Full mode rewrites links and blocks third-party content so the visitor's browser never reaches out to the clear internet. Lite mode only fixes the basics and will leak the visitor on any site with absolute links. Lite is for sites you know use only relative links.

Back up the key, but guard the backup

A plaintext eepsite.dat in a backup is enough to impersonate your service. Encrypt your backups, and if you use encryption at rest, store the passphrase apart from the key folder. See Backing up your key and Encrypt at rest.

Do not weaken the hardening

The generated compose file drops privileges, runs read-only, and keeps the backend off the internet. Every one of those flags is there for a reason. If you start removing them to make something convenient work, you are trading away the protection you came for. Fix the underlying problem instead.

Verify what you run

Before you trust a pulled image, verify its signatures and, if you care about supply chain, rebuild it and confirm the digest matches. See Verifying the image. Trusting a tampered image would undo everything else on this page.