Editing IPsec (section)

===Tunnel mode ===
In tunnel mode, the entire IP packet is encrypted and authenticated. It is then encapsulated into a new IP packet with a new IP header. Tunnel mode is used to create [[virtual private network]]s for network-to-network communications (e.g. between routers to link sites), host-to-network communications (e.g. remote user access) and host-to-host communications (e.g. private chat).<ref>William, S., & Stallings, W. (2006). Cryptography and Network Security, 4/E. Pearson Education India. p. 492-493</ref>

Tunnel mode supports NAT traversal.