SOCKS Proxy

Using I2P's SOCKS tunnel safely (updated for 2.10.0)

Caution: The SOCKS tunnel forwards application payloads without sanitizing them. Many protocols leak IPs, hostnames, or other identifiers. Only use SOCKS with software you have audited for anonymity.


1. Overview

I2P provides SOCKS 4, 4a, and 5 proxy support for outbound connections through an I2PTunnel client. It enables standard applications to reach I2P destinations but cannot access clearnet. There is no SOCKS outproxy, and all traffic remains within the I2P network.

Implementation Summary

ParameterJava I2Pi2pd
Default PortUser-defined127.0.0.1:4447
Supported SOCKS Versions4, 4a, 54, 4a, 5
UDP ModeStubbed (non-functional)Stubbed (non-functional)
Persistent Keys✅ Since 0.9.9
Shared Client TunnelsSupportedSupported
Outproxy Support❌ None❌ None

Supported address types:

  • .i2p hostnames (addressbook entries)
  • Base32 hashes (.b32.i2p)
  • No Base64 or clearnet support

2. Security Risks and Limitations

Application-Layer Leakage

SOCKS operates below the application layer and cannot sanitize protocols. Many clients (e.g., browsers, IRC, email) include metadata that reveals your IP address, hostname, or system details.

Common leaks include:

  • IPs in mail headers or IRC CTCP responses
  • Real names/usernames in protocol payloads
  • User-agent strings with OS fingerprints
  • External DNS queries
  • WebRTC and browser telemetry

I2P cannot prevent these leaks—they occur above the tunnel layer. Only use SOCKS for audited clients designed for anonymity.

Shared Tunnel Identity

If multiple applications share a SOCKS tunnel, they share the same I2P destination identity. This enables correlation or fingerprinting across different services.

Mitigation: Use non-shared tunnels for each application and enable persistent keys to maintain consistent cryptographic identities across restarts.

UDP Mode Stubbed Out

UDP support in SOCKS5 is not implemented. The protocol advertises UDP capability, but calls are ignored. Use TCP-only clients.

No Outproxy by Design

Unlike Tor, I2P does not offer SOCKS-based clearnet outproxies. Attempts to reach external IPs will fail or expose identity. Use HTTP or HTTPS proxies if outproxying is required.


3. Historical Context

Developers have long discouraged SOCKS for anonymous use. From internal developer discussions and the 2004 Meeting 81 and Meeting 82:

“Forwarding arbitrary traffic is unsafe, and it behooves us as developers of anonymity software to have the safety of our end users foremost in our minds.”

SOCKS support was included for compatibility but is not recommended for production environments. Nearly every internet application leaks sensitive metadata unsuited to anonymous routing.


4. Configuration

Java I2P

  1. Open the I2PTunnel Manager
  2. Create a new client tunnel of type “SOCKS 4/4a/5”
  3. Configure options:
    • Local port (any available)
    • Shared client: disable for separate identity per app
    • Persistent key: enable to reduce key correlation
  4. Start the tunnel

i2pd

i2pd includes SOCKS5 support enabled by default at 127.0.0.1:4447. Configuration in i2pd.conf under [SOCKSProxy] allows you to adjust port, host, and tunnel parameters.


5. Development Timeline

VersionChangeDate
0.7.1Initial SOCKS 4/4a/5 support2010
0.9.9Added persistent keying2013
1.7.0BOB API deprecated and removed2022
2.6.0I2P-over-Tor blocked to improve network health2024
2.10.0Post-quantum hybrid encryption introduced2025

The SOCKS module itself has seen no major protocol updates since 2013, but the surrounding tunnel stack has received performance and cryptographic improvements.


For any production, public-facing, or security-critical application, use one of the official I2P APIs instead of SOCKS:

APIDescriptionRecommended For
SAM v3 (3.3)Simple Anonymous Messaging APICross-language apps needing socket-like I/O
Streaming LibraryTCP-like sockets for JavaNative Java integrations
I2CPLow-level router communicationCustom protocols, router-level integration
BOBDeprecated (removed 2022)Legacy only; migrate to SAM

These APIs provide proper destination isolation, cryptographic identity control, and better routing performance.


7. OnionCat / GarliCat

OnionCat supports I2P through its GarliCat mode (fd60:db4d:ddb5::/48 IPv6 range). Still functional but with limited development since 2019.

Usage caveats:

  • Requires manual .oc.b32.i2p configuration in SusiDNS
  • Needs static IPv6 assignment
  • Not officially supported by the I2P project

Recommended only for advanced VPN-over-I2P setups.


8. Best Practices

If you must use SOCKS:

  1. Create separate tunnels per application.
  2. Disable shared client mode.
  3. Enable persistent keys.
  4. Force SOCKS5 DNS resolution.
  5. Audit protocol behavior for leaks.
  6. Avoid clearnet connections.
  7. Monitor network traffic for leaks.

9. Technical Summary

ParameterValue
Supported SOCKS Versions4, 4a, 5
TransportTCP only
UDP SupportStubbed (non-functional)
Clearnet AccessNot supported
Default PortsJava I2P: user-set; i2pd: 127.0.0.1:4447
Persistent KeyingSupported since 0.9.9
Shared TunnelsSupported (discouraged)

10. Conclusion

The SOCKS proxy in I2P provides basic compatibility with existing TCP applications but is not designed for strong anonymity guarantees. It should only be used for controlled, audited testing environments.

For serious deployments, migrate to SAM v3 or the Streaming API. These APIs isolate application identities, use modern cryptography, and receive ongoing development.


Additional Resources

Was this page helpful?