Disclaimer: My understanding of the types of VPNs and IPSec is limited.
What I am struggling to understand is the fact that the IP header is not encrypted in transport-mode IPSec.
My understanding of VPNs: There is a well-known VPN server, you connect to it, and everything you send to it gets encrypted. Your local ISP sees you connecting to only one IP address, that of the VPN provider's server. In reality, you connect to many different sites through the VPN server.
If the above is true, how does transport-mode IPSec work, given that the original IP headers are not modified? That is, I am visiting example.com, and I don't want its IP address to be visible to my ISP. Wouldn't the example.com site need to be running IPSec as well? In such a configuration, how does the VPN provider's server come into play? Really confusing.
Is transport-mode IPSec used when connecting from a host to a VPN server?