What Is IPsec?
On this page
IPsec (Internet Protocol Security) secures traffic at the network layer, encrypting and authenticating IP packets themselves. Because it operates below the applications, it protects everything flowing between two endpoints transparently — which is why it is the classic foundation for VPNs. Where TLS secures a single application’s connection, IPsec can secure the whole pipe.
How does IPsec work?#
IPsec combines a few protocols and modes:
- Protocols: ESP (Encapsulating Security Payload) provides encryption and authentication; AH (Authentication Header) provides authentication only. ESP is by far the common choice.
- Key exchange: IKE (Internet Key Exchange) negotiates keys and parameters, much like a TLS handshake.
- Modes: transport vs tunnel.
| Mode | Encrypts | Use |
|---|---|---|
| Transport | Payload only | Host-to-host |
| Tunnel | Entire packet, re-wrapped | Site-to-site / remote VPN |
Tunnel mode is what lets a VPN hide internal addressing: the original packet is fully encrypted and placed inside a new one addressed between the VPN gateways.
IPsec or TLS?#
They operate at different layers and suit different jobs. IPsec secures all traffic between networks or endpoints transparently, ideal for site-to-site connectivity. TLS secures specific application connections and is what the web uses. Many architectures use both.
IPsec is network-layer transport security. More at the Network Security hub.
Frequently asked questions#
What is IPsec used for?
IPsec (Internet Protocol Security) is a suite of protocols that encrypts and authenticates traffic at the network (IP) layer. It is most commonly used to build VPNs — securing all traffic between two networks or between a device and a network — transparently to the applications above, which need no awareness of it.
What is the difference between IPsec transport and tunnel mode?
Transport mode encrypts only the payload of each IP packet, leaving the original headers, and is used for host-to-host communication. Tunnel mode encrypts the entire original packet and wraps it in a new one, which is how site-to-site and remote-access VPNs work — hiding the internal addressing as traffic crosses the internet.