Does IPSec work below or above the network(IP) layer? If below then how does a router read the destination IP address which is encrypted inside the IPSec encryption?
- IPSec Tunnel Mode.
IPSec is above the IP layer, but inside the encrypted IPSec packet, there is the original IP and payload.
IPSec wraps the original packet, encrypts it, adds a new IP header and sends it to the other side of the VPN tunnel.
- IPSec Transport Mode
Now IPSec only protects the data, and uses the original IP header, just changing the protocol field.