diff --git a/router/java/src/net/i2p/router/networkdb/kademlia/MessageWrapper.java b/router/java/src/net/i2p/router/networkdb/kademlia/MessageWrapper.java
index c3a076729..04a537e5f 100644
--- a/router/java/src/net/i2p/router/networkdb/kademlia/MessageWrapper.java
+++ b/router/java/src/net/i2p/router/networkdb/kademlia/MessageWrapper.java
@@ -132,9 +132,9 @@ public class MessageWrapper {
      *
      *  @param to must be ELGAMAL_2048 or ECIES_X25519 EncType
      *  @return null on encrypt failure
-     *  @since 0.9.5
+     *  @since 0.9.5, public since 0.9.50 for BuildRequestor
      */
-    static GarlicMessage wrap(RouterContext ctx, I2NPMessage m, RouterInfo to) {
+    public static GarlicMessage wrap(RouterContext ctx, I2NPMessage m, RouterInfo to) {
 
         PayloadGarlicConfig payload = new PayloadGarlicConfig(Certificate.NULL_CERT,
                                                               ctx.random().nextLong(I2NPMessage.MAX_ID_VALUE),
diff --git a/router/java/src/net/i2p/router/tunnel/pool/BuildRequestor.java b/router/java/src/net/i2p/router/tunnel/pool/BuildRequestor.java
index e158dda4d..9a5177739 100644
--- a/router/java/src/net/i2p/router/tunnel/pool/BuildRequestor.java
+++ b/router/java/src/net/i2p/router/tunnel/pool/BuildRequestor.java
@@ -9,6 +9,8 @@ import net.i2p.data.Hash;
 import net.i2p.data.PublicKey;
 import net.i2p.data.router.RouterInfo;
 import net.i2p.data.TunnelId;
+import net.i2p.data.i2np.I2NPMessage;
+import net.i2p.data.i2np.InboundTunnelBuildMessage;
 import net.i2p.data.i2np.TunnelBuildMessage;
 import net.i2p.data.i2np.VariableTunnelBuildMessage;
 import net.i2p.router.JobImpl;
@@ -17,6 +19,7 @@ import net.i2p.router.RouterContext;
 import net.i2p.router.TunnelInfo;
 import net.i2p.router.TunnelManagerFacade;
 import net.i2p.router.TunnelPoolSettings;
+import net.i2p.router.networkdb.kademlia.MessageWrapper;
 import net.i2p.router.tunnel.BuildMessageGenerator;
 import net.i2p.router.tunnel.HopConfig;
 import net.i2p.router.tunnel.TunnelCreatorConfig;
@@ -46,7 +49,6 @@ abstract class BuildRequestor {
             MEDIUM_ORDER.add(Integer.valueOf(i));
         }
     }
-
     private static final int PRIORITY = OutNetMessage.PRIORITY_MY_BUILD_REQUEST;
 
     /**
@@ -193,7 +195,7 @@ abstract class BuildRequestor {
         }
         
         //long beforeCreate = System.currentTimeMillis();
-        TunnelBuildMessage msg = createTunnelBuildMessage(ctx, pool, cfg, pairedTunnel, exec);
+        I2NPMessage msg = createTunnelBuildMessage(ctx, pool, cfg, pairedTunnel, exec);
         //long createTime = System.currentTimeMillis()-beforeCreate;
         if (msg == null) {
             if (log.shouldLog(Log.WARN))
@@ -206,14 +208,33 @@ abstract class BuildRequestor {
         
         //long beforeDispatch = System.currentTimeMillis();
         if (cfg.isInbound()) {
+            Hash ibgw = cfg.getPeer(0);
+            if (msg.getType() == InboundTunnelBuildMessage.MESSAGE_TYPE) {
+                // ITBM is garlic encrypted to the IBGW, to hide it from the OBEP
+                RouterInfo peer = ctx.netDb().lookupRouterInfoLocally(ibgw);
+                if (peer != null) {
+                    I2NPMessage enc = MessageWrapper.wrap(ctx, msg, peer);
+                    if (enc != null) {
+                        msg = enc;
+                        // log.debug("wrapping IB TBM to " + ibgw);
+                    } else {
+                        if (log.shouldWarn())
+                            log.warn("failed to wrap IB TBM to " + ibgw);
+                    }
+                } else {
+                    if (log.shouldWarn())
+                        log.warn("no RI, failed to wrap IB TBM to " + ibgw);
+                }
+            }
+
             if (log.shouldLog(Log.INFO))
                 log.info("Sending the tunnel build request " + msg.getUniqueId() + " out the tunnel " + pairedTunnel + " to " 
-                          + cfg.getPeer(0) + " for " + cfg + " waiting for the reply of "
+                          + ibgw + " for " + cfg + " waiting for the reply of "
                           + cfg.getReplyMessageId());
             // send it out a tunnel targetting the first hop
             // TODO - would be nice to have a TunnelBuildFirstHopFailJob queued if the
             // pairedTunnel is zero-hop, but no way to do that?
-            ctx.tunnelDispatcher().dispatchOutbound(msg, pairedTunnel.getSendTunnelId(0), cfg.getPeer(0));
+            ctx.tunnelDispatcher().dispatchOutbound(msg, pairedTunnel.getSendTunnelId(0), ibgw);
         } else {
             if (log.shouldLog(Log.INFO))
                 log.info("Sending the tunnel build request directly to " + cfg.getPeer(1)