are you seeding AI datasets?

It's true, you never really know what will be going through your router. I guess I just got over it after a few years of struggling with VPNs and port-forwarding. Just felt like the noose was getting tighter, especially after Mullvad stopped providing the feature. My stance is that if I ever knew that such content was going through my PC I would block it, but if it's all encrypted then what can I do? Same reason why I support encrypted messaging apps - they can be used for harm but is that the fault of the tool? Though I recognize it's a complex issue.

This was mentioned in the other thread but I should probably mention it here as well. Unlike with TOR, in I2P every user is also expected to be a router. I think this is great and helps encourage decentralization, scaling, and DDoS resistance. Techlore mentioned something similar in one of his videos (but I can't find it right now). However, this does mean that you never really know what traffic is going through your router. It's all encrypted, but some users may still have concerns with that. I wrote my own opinions on this topic in that same comment thread.

It's not just the router. The officially recommended I2P torrent client, called I2PSnark, is also in Java and its a pain to get working in Docker. It's not a bad torrent client, just feels like the official I2P tools still don't have great support for modern Linux devops. Now that qBittorrent supports I2P the whole stack feels much more at home.

If exposing hostnames and IP addresses is dangerous

It's not necessarily dangerous, but it's a major privacy issue. Hiding your browsing history from other people (except for the VPN provider) is one of the main reasons why people get a commercial VPN in the first place. And this vulnerability mainly concerns those users.

If you're willing to take the time to learn a bit of podman/docker, you should check out my recent post on I2P torrenting. There's no problems with port forwarding on the I2P network. There are other ways to torrent over I2P without podman/docker too, you'll just have to research them yourself

There's basically only one, listed towards the bottom of the guide in the repo: http://tracker2.postman.i2p/. And it's "public" but only accessible via I2P. I tried to explain everything in the repo so let me know if I missed anything!

From a privacy standpoint I don't think it would make a big difference over not using a VPN at all. It will take a bit of time but your new IP will become associated with your identity. From the perspective of Facebook and Google, it will just look like you moved and are living inside a datacenter now.

Thanks for the info, I would not claim to be an expert about I2P so some of this is definitely new to me. Though I think the situation has improved quite a bit.

Complex configuration process: It necessitates a drawn-out installation procedure and specific browser settings.

If you just want I2P without the torrenting, you can use the official I2P router, which is just an HTTP proxy that runs on your PC, just like Tor. The 3rd-party router used in my guide, i2pd, has a Flatpak as well. So as far as installing the router goes, it's a few clicks. You are correct that it does require configuring the browser though, you are correct. This is explained in my guide and also on the official website. Not as easy as clicking an "Install" button, but only takes around 5 minutes. I wish there were an official I2P browser like the Tor browser though.

Must-have logging: The I2P user interface must be logged in for users to access their material.

Not sure what you mean by this. I've never had to log into anything to set up I2P.

Severe vulnerabilities

I have no doubt. But Tor has had many vulnerabilities too. Both have gotten much better over time.

A much tiner user base than TOR: As a result, I2P has fewer network nodes and servers and is more open to intrusions.

Definitely true. In fact it makes me suspicious how fast TOR is despite how many users there are, and how the relatively high requirements to be a relay (not to mention an exit node). AFAIK TOR is heavily reliant on rich and generous patrons, which makes me wonder about the motives of these patrons. I believe I2P has the potential to be much more decentralized, since every user is expected to also be a router, and Techlore has also raised this point (though I don't have the video on me right now).

Less anonymity when browsing indexed sites: I2P does not ensure that users’ browsing of indexed sites is completely anonymous. The use of VPN services may be able to address this issue.

I didn't know this. What are indexed sites?

That sounds very cool, I've been interesting in network namespaces but it's hard to find information on how to use them. How did you do it?

I added clarification that the HTTPS part is assuming that the attacker has already performed the DHCP attack. Thanks for the note!

The DHCP race is one part I didn't go into detail about since I'm not very familiar with the details, but what you wrote makes sense. One potential danger is a hacker at a coffee shop, where the shop owner is unlikely to be monitoring the network, and there are going to be many new connections coming in all the time. It's still an unlikely scenario, but it also isn't a particularly difficult attack.

Great write-up, I've been looking for something like this. I've heard of vopono and eznetns before but not namespaced-openvpn, and this is the first post I've seen where somebody details how they use a tool like this, so thanks! I'll have to try setting it up some time.

I saw that but unfortunately it doesn't detail how to set it up persistently on every boot. And I also haven't seen anybody using this method, probably because of the lack of tooling around it. For example afaik the official Mullvad client on linux just uses a firewall.

Yeah, you don't have to dig very deep to find out how insecure our networks are. Mac addresses can be spoofed, ports can be scanned, TCP numbers can be guessed, etc...

Using untrusted networks is quite common, like coffee shop wifi or airport wifi.

what features are you talking about?

How do you route all a host system's traffic through Gluetun? If you use routing tables, wouldn't it similarly be affected by TunnelVision? In which case you would still need a firewall on the host...

Also, the host system likely makes network requests right after boot, before a Gluetun container has time to start. How do you make sure those don't leak?

I am curious though, how you were able to route all host traffic through Gluetun. I know it can be used as a http/socks proxy, but I only know of ways to configure your browser to use that. What about other applications and system-level services? What about other kinds of traffic, like ssh?

I'm no network security expert, so I mainly followed Mullvad VPN for my implementation. I looked at the nftables rules that official Mullvad linux client uses, and also their document here: https://github.com/mullvad/mullvadvpn-app/blob/main/docs/security.md.

Though if you have any alternatives for vanilla wireguard users like me, I'll gladly switch. I know somebody mentioned Gluetun but I thought that was for docker only. Do you know of any others?

I think you both are talking past each other. You said "But if nobody else is using those same endpoints." but @[email protected] said "There’s plenty of people who are going to be renting VPSes and will have their traffic originate from the same IP range as mine". Reading this thread, it seems like you both have different network setups in mind.

It all depends on how much you trust the devices on your LAN. So your ISP can't do anything unless they own and control your router, since that is on your LAN. So one concern might be if you connect your PC to coffee shop wifi, since all other devices in the shop are on the same LAN, not to mention the coffee shop owns the wifi router and can also perform the attack. Another concern might be if a family member in your house has a device that got hacked, then all devices in your house are vulnerable.