IPsec (2)

Tunnel Mode

the entire IP packet is encrypted and / or authenticated

the whole packet is encapsulated in another IP packet for routing to work

Transport Mode

only the payload of the IP packet is encrypted

used for host-to-host communication