Abstract
Qubes provides very useful and easy qvm-connect-tcp interface, and this interface can be used for i2p router intergration
This guide provides solution for router / client splited system, like whonix gateway/workstation, but for i2p network
Why not netvm
Yes using netvm for this variant its good, but qvm-connect-tcp provides easier interface (firewall rules not required, only qubes policy) for i2p router ports forwarding (but without udp tunnels)
Creating i2p router
Router realization note
I use i2pd in this guide, because this router contained in debian repos by default
Cloning and setuping template for router
If you don`t have kicksecure (18 version in this guide) connect community templates repository in global settings and install kicksecure-18 template
You need dedicated template for router copied from kicksecure-18 (i call this clone kicksecure-18-i2p)
Purging template from useless blobs
Router template dont require any non-free packages and this can be remove without problems
Just run this command in templatevm
sudo apt autopurge -y firmware-* *-firmware
And remove non-free, non-free-firmware and contrib lines from /etc/apt/sources.list.d
Unify timezone in template
sudo timedatectl set-timezone Etc/UTC
echo "Etc/UTC" | sudo tee /etc/timezone
And this in dom0
qvm-features kicksecure-18-i2p anon-timezone 1
qvm-features kicksecure-18-i2p gui-events-max-delay 200
Installing tirdad in template
Tirdad is ISN randomization module developed by whonix developers for side channel leaks protection
sudo apt install -y linux-image-amd64 linux-headers-amd64 grub2 qubes-kernel-vm-support tirdad
sudo grub-install /dev/xvda
And set provided by qube in advanced settings of template
Protect hardware and pid information
sudo systemctl enable hide-hardware-info.service proc-hidepid.service
Installing i2pd
sudo apt install -y i2pd
Creating sys-i2p appvm
Create sys-i2p vm based on kicksecure-18-i2p template and you are default netvm, with qube provided kernel, don`t forget about autostart in settings
Run this command on dom0 side
qvm-features sys-i2p anon-timezone 1
qvm-features sys-i2p gui-events-max-delay 200
qvm-features sys-i2p servicevm 1 # this moves qube to service tab in application menu
And run sys-i2p qube
Moving i2p config to /rw
Spawning root terminal in sys-i2p
qvm-run -u root sys-i2p qterminal
And run this commands in root sys-i2p terminal
sudo systemctl stop i2pd
cd /rw/bind-dirs
cp -ra /var/lib/i2pd var/lib
mkdir etc
cp -ra /etc/i2pd etc
cd /rw/config
mkdir qubes-bind-dirs.d
echo "binds+=( '/var/lib/i2pd' )" >> qubes-bind-dirs.d/50_user.conf
echo "binds+=( '/etc/i2pd' )" >> qubes-bind-dirs.d/50_user.conf
And its just works! restart sys-i2p and curl 127.0.0.1:7070
Writing a qubes policy
Qubes os policies contains in /etc/qubes/policy.d directory
Base template
50-i2p.policy
# Simple http proxy
qubes.ConnectTCP +4444 @tag:anon-vm-i2p sys-i2p allow target=sys-i2p
# SAM interface
qubes.ConnectTCP +7656 @tag:anon-vm-i2p-sam sys-i2p allow target=sys-i2p
# Viewer
qubes.ConnectTCP +7070 sys-i2p-viewer sys-i2p allow target=sys-i2p
Note for identity isolation
Your client tunnels like typical tcp tunnel or proxy has unique b32 address created from public keys, you can change this address for tunnels without keys= argument in tunnels.conf using Router Command → Reload tunnel configuration
Note for separate sam and http proxy tags
SAM provides full control for tunnels creation for applications, its can be used for very very easy deanon, add anon-vm-i2p-sam tag only in trusted appvms
Creating more isolated proxies
I2pd tunnels configuration contains in /var/lib/i2pd/tunnels.conf
[Any name for proxy]
type = httpproxy
address = 127.0.0.1
port = any free port
#Optional
keys = Add key for stable pseudonym activity.key
Creating sys-i2p-viewer
Why
By default kicksecure don`t have browser, and i not recommended installing browser to i2p router template
This qube must be used for i2pd webconsole browsing
Creating qube
Your qube must be based on template with firefox, and be disposable qube template
Setuping disposable template
Forward webconsole port from router to viewer
echo "qvm-connect-tcp 7070:sys-i2p:7070" | sudo tee -a /rw/config/rc.local
Autostart browser with webconsole
mkdir /home/user/.config/autostart
cp /usr/share/applications/firefox-esr.desktop /home/user/.config/autostart
Replace Exec line to this
Exec=/usr/lib/firefox-esr/firefox-esr 127.0.0.1:7070
And just create disposable qube based on disposable template called sys-i2p-viewer
Creating disposable template for i2p browser
Base settings of new disposable template
Name → Any
Template → whonix-workstation-18
Net qube → (none)
Kernel → provided by qube
Applications must have tor browser
Setuping disposable template tags
qvm-tags your disposable template name add anon-vm-i2p
Adding browser policy for i2p http proxy usage
Add this to /rw/config/rc.local of disposable template (in spawned root terminal)
bootclockrandomization
cp -a /rw/config/policies.json /var/cache/tb-binary/.tb/tor-browser/Browser/distribution
chown user /var/cache/tb-binary/.tb/tor-browser/Browser/distribution/policies.json
chgrp user /var/cache/tb-binary/.tb/tor-browser/Browser/distribution/policies.json
qvm-connect-tcp 4444:sys-i2p:4444
/rw/config/policies.json file
{
"policies": {
"Preferences": {
"browser.tabs.inTitlebar": {
"Value": 0
},
"browser.security_level.security_slider": { # FIXME: Remove this comment before coping, please set maximum security level manual on every disp start
"Value": 3
},
"browser.theme.content-theme": {
"Value": 0,
"Status": "locked"
},
"extensions.activeThemeID": {
"Value": "firefox-compact-dark@mozilla.org"
},
"extensions.torbutton.use_nontor_proxy": {
"Value": true
},
"network.proxy.http": {
"Value": "127.0.0.1"
},
"network.proxy.http_port": {
"Value": 4444
},
"network.proxy.no_proxies_on": {
"Value": "127.0.0.1"
},
"dom.security.https_first_pbm": {
"Value": false
},
"dom.security.https_only_mode": {
"Value": false
},
"dom.security.https_only_mode_pbm": {
"Value": false
},
"browser.startup.homepage": {
"Value": "about:tor",
"Status": "locked"
}
},
"DisplayBookmarksToolbar": "never"
}
}
Appendix
Root spawned terminals
I known about user/sysmaint splitting and root spawned terminal its bad idea, but this not permanent solution just for bootstrap setuping
SAM/I2CP isolation problems
This problem on java and c++ i2p routers side, not me
Internet port forwarding
See other guides for this theme, and known i2pd randomize port on every restart
Goodbye!
Don`t forget about graceful shutdown of your router, have a nice day!