Does AH in tunneling mode provide encryption?

Question

I've been reading on IP sec for a few days, and i have some confusion on the differences between AH and ESP in tunnel/transport mode. I understand that AH only provides authentication and integrity checks, but NO encryption (ESP does provide encryption). So far so good. However, reading on Tunnel / transport mode always says that tunnel mode encrypts the entire IP packet, and transport mode only encrypts the payload but leaves the headers intact. Even on the main article of IP sec on Wikipedia it says

"In tunnel mode, the entire IP packet is encrypted and authenticated. It is then encapsulated into a new IP packet with a new IP header(...)"

However, multiple questions on this topic state that AH with tunnel mode doesn't provide encryption. So, which is it? Do tunnel / transmission modes always guarantee some kind of encryption (either on the full packet or only in the payload), or is the Wikipedia's article wrong (very unlikely) and Tunnel / Transport modes only provide encryption when using ESP and not AH?

(here's one example question where accepted answer states that AH in tunnel mode only guarantees integrity and authenticity checks, and not encryption: IPsec: Is AH in tunnel mode secure?)

Thanks!

Answer 1

AH mode doesn't provide encryption, it only makes the traffic it tamper-proof. It doesn't matter whether it's in transport or tunnel mode. If you need encryption then ESP is what you need.

That distinction your read between tunnel and transport mode is relevant only when using ESP. In case you need to hide the endpoints of the traffic then you need to use tunnel mode, as this info is always visible in transport mode.