Disclaimer: My understanding of the types of VPNs and IPSec is limited.

What I am struggling to understand is the fact that the IP header is not encrypted in transport-mode IPSec.

My understanding of VPNs: There is a well-known VPN server, you connect to it, and everything you send to it gets encrypted. Your local ISP sees you connecting to only one IP address, that of the VPN provider's server. In reality, you connect to many different sites through the VPN server.

If the above is true, how does transport-mode IPSec work, given that the original IP headers are not modified? That is, I am visiting example.com, and I don't want its IP address to be visible to my ISP. Wouldn't the example.com site need to be running IPSec as well? In such a configuration, how does the VPN provider's server come into play? Really confusing.

Is transport-mode IPSec used when connecting from a host to a VPN server?

  • Keep in mind, the original use case of VPNs is not the same as what they are advertised for today. The original goal was to allow secure access to a network from a remote location. Oct 10, 2021 at 20:29

1 Answer 1


Is transport-mode IPSec used when connecting from a host to a VPN server?

No, it's used to connect two single hosts (without considering NATs or BEET mode). Tunnel mode is used for classic VPN scenarios.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.