Can I use tranport mode (instead of tunnel mode) in IPsec if I tunnel a VPN via UDP? I don't see why the header (that sets the protocol and port) needs to be encrypted in my case (I suspect it would be dropped if the firewall cannot see it as UDP and an OK port). The security policy would apply to the other/peer host doing things the same way, of course.

Clarification: my packets need to go out as UDP so bare IPsec is not an option for me. Maybe I should do RFC3948 UDP Encapsulation of IPsec ESP Packets without AH or IKE for my needs. I am using PSK. Is this NAT Traversal I am ending up with?

1 Answer 1


In light of your edit:

An IPSec system supporting RFC3948 will do what you want, yes, assuming you do not need AH and that you're using either IKE or IKEv2.

However, the whole system has been designed for NAT traversal so I'm not certain it exactly fits your requirement (you didn't specify WHY you need to limit yourself to UDP or why you want to use IPsec).

  • i need to go through as protocol UDP so maybe i can re-encapsulate. that or use OpenVPN instead of IPsec.
    – Skaperen
    Jun 16, 2015 at 12:01
  • You need to redefine your question properly, then: you're not making much sense
    – Stephane
    Jun 16, 2015 at 12:02
  • maybe i am totally off track thinking about IPsec. see question edit i just did. i am trying to do like OpenVPN but need to skip ALL negotiations at the start because they won't go through. IPsec looked interesting because i could re-key it on the fly.
    – Skaperen
    Jun 16, 2015 at 12:19
  • RFC3948 will not let your use manual keying, I'm afraid. Maybe you should explain your problem and ask to solve it instead because it's hard to give you options when we have no clue about your environment.
    – Stephane
    Jun 16, 2015 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .