A two-hop relay mechanism—where a message is first sent to a first relay, which then forwards it to a second relay that the recipient receives from—is a good approach for protecting IP addresses.