I've been reading on IP sec for a few days, and i have some confusion on the differences between AH and ESP in tunnel/transport mode. I understand that AH only provides authentication and integrity checks, but NO encryption (ESP does provide encryption). So far so good. However, reading on Tunnel / transport mode always says that tunnel mode encrypts the entire IP packet, and transport mode only encrypts the payload but leaves the headers intact. Even on the main article of IP sec on Wikipedia it says
"In tunnel mode, the entire IP packet is encrypted and authenticated. It is then encapsulated into a new IP packet with a new IP header(...)"
However, multiple questions on this topic state that AH with tunnel mode doesn't provide encryption. So, which is it? Do tunnel / transmission modes always guarantee some kind of encryption (either on the full packet or only in the payload), or is the Wikipedia's article wrong (very unlikely) and Tunnel / Transport modes only provide encryption when using ESP and not AH?
(here's one example question where accepted answer states that AH in tunnel mode only guarantees integrity and authenticity checks, and not encryption: IPsec: Is AH in tunnel mode secure?)