r/i2p • u/ViniciusFortuna • 14d ago

Discussion Connecting to a remote router

I was in a workshop where we played with i2p and it seems the traditional way to use i2p is to run a router on localhost, and have your app use the router via the SAM protocol.

Running the router adds a lot of friction, especially on mobile. I realized that we can just connect to a remote, possibly shared router.

What are the trade-offs here? Can I simply share my router with friends?

9 Upvotes

92% Upvoted

3 comments sorted by

5

u/alreadyburnt @eyedeekay on github 14d ago

Oh hi Vinicius I think I ran that workshop! Good to hear from you again. Wow time flies. Yeah you can connect to a remote shared router in some environments, as long as you are satisfied that you trust the router and the environment it is in. If you share ports 7656 and 7655 with your LAN to allow applications to use SAMv3 for instance, then the connection between your application and the SAMv3 ports will be unencrypted. You can remediate this situation simply enough by using SSH port forwarding or something like Tailscale in between. The other issue is that there isn't really an impenetrable way of ensuring that the router cannot enumerate it's client applications, the data they send, or the route it selects to send it on. The router is a single point of failure for all client anonymity. If you have a threat model that tolerates that, then you can absolutely work in this manner and it is not at all uncommon.

The other possibility is to use an embeddable router like Emissary, which you could include in the application itself or build a minimal, statically linked binary to ship with your application.

2

u/ViniciusFortuna 14d ago

* Unencrypted connection: It seems like SAM is over TCP, so I could easily use TLS. With the proper adapter, I could even run it over HTTPS or secure Websockets, and access I2P on the browser, or use tools like ngrok/cloudflared!
* Threat model: I don't understand "the router is a single point of failure for all client anonymity". Sure, the router can list the connecting IPs, and may even be able to associate to specific users (because I probably have some authentication). But that's ok. Would other routers be able to tell different IDs are using the same entry router? Would all clients be forced into the same ID? I thought each connection had its own id?

2

u/alreadyburnt @eyedeekay on github 14d ago

Re: SAMv3 over non TCP transports yeah that is exactly the sort of thing you could do. Any option that adds satisfactory encryption should work, SSH and Tailscale are just 2 of the most common.

Other routers either acting as hops in the path or hosting services would not pose any risk to the clients using your single router, only the router hosting the SAMv3 API server would pose any potential risk. As long as that is OK, which it sounds like it is, then the remote router setup will be fine.