Privacy is one of the main concerns for Internet users. In many situations, users would like to conceal their identities when accessing the Internet. Some would want to hide their identities when accessing specific services, and others may even want to be anonymous to other hosts they are communicating with. Anonymity is sometimes a must for applications like electronic voting, and in other situations it is optional such as the case of Web browsing. Moreover, hiding the identities of communicating parties helps alleviate problems related to traffic analysis. In this paper, we propose two anonymity models to ensure the privacy of communicating parties and to protect the sender address during the routing process and hence render such sender unidentifiable and untraceable. The results analyses show that our models have anti-spoofing capability and high anonymity degree even when some nodes on the path are compromised. In the first proposed model, the request and the reply can be linked, however, in the second model they cannot be linked at an additional overhead cost. The measurements showed that the additional incurred delay on each collaborative router varies between 1.35 and 3.3 ms, and hence the end-to-end delay is negligible for typical Internet paths.