Can I use tranport mode (instead of tunnel mode) in IPsec if I tunnel a VPN via UDP? I don't see why the header (that sets the protocol and port) needs to be encrypted in my case (I suspect it would be dropped if the firewall cannot see it as UDP and an OK port). The security policy would apply to the other/peer host doing things the same way, of course.
Clarification: my packets need to go out as UDP so bare IPsec is not an option for me. Maybe I should do RFC3948 UDP Encapsulation of IPsec ESP Packets without AH or IKE for my needs. I am using PSK. Is this NAT Traversal I am ending up with?